CVE-2019-13396

What it actually does

The vulnerability permits unauthenticated directory traversal and local file inclusion by supplying an attacker-controlled value to the form_include parameter in a POST request to index.php?q=system-handle-form-submit, which is then passed directly to an include_once call inside modules/system/system.module without sanitization.

Why it matters to the business

Attackers may read arbitrary files on the server, exposing configuration data, credentials, or source code that can be leveraged for further compromise of the application and its hosted data.

How an attack unfolds

An attacker identifies the vulnerable FlightPath installation, crafts a POST request targeting the system form handler, and supplies traversal sequences in the form_include parameter to force inclusion of sensitive local files such as configuration or password stores.

How to fix it

Upgrade FlightPath to a version that removes or securely handles the form_include parameter; alternatively, enforce strict allow-list validation on all file-inclusion inputs and disable direct inclusion of user-supplied paths.

How to confirm the fix worked

Inspect modules/system/system.module to confirm the form_include parameter is no longer passed to include_once, then test the endpoint with known traversal payloads to verify they are rejected or sanitized.

Typical attack path

1. Locate a reachable FlightPath instance exposing the system form handler
2. Send a POST request to index.php?q=system-handle-form-submit containing a malicious form_include value
3. Observe file contents returned in the response
4. Use disclosed information to obtain credentials or pivot to other assets

How to detect it

Search web server access logs for POST requests containing q=system-handle-form-submit together with a form_include parameter that includes sequences such as ../ or absolute paths; correlate with responses returning file contents.

• q=system-handle-form-submit
• form_include=../
• POST /index.php
• system_handle_form_submit

What your security team should do

• Apply the latest FlightPath release or back-port input validation fixes
• Deploy WAF rules blocking path traversal patterns in form submissions
• Audit all file-inclusion code paths for similar weaknesses
• Review web server logs for historical traversal attempts