Nivocart
Monthly
NivoCart through 2.5.1 allows unauthenticated attackers to retrieve guest order invoices via the account/order download() action by iterating order_id values, exposing sensitive customer information such as names, addresses, telephone numbers, emails, purchased items, and order totals. The missing authorization check (CWE-862) affects installations that use guest checkout, as guest orders are stored with customer_id 0. No public exploit identified at time of analysis, though the enumeration is straightforward due to the lack of authentication requirements (CVSS PR:N).
Administrative account takeover in NivoCart through 2.4.0 is possible because the forgotten.php password-reset flow derives recovery codes from PHP's non-cryptographic mt_rand() and MD5, allowing unauthenticated remote attackers who know a valid administrator email address to predict or brute-force the 10-hex-character token and reset the administrator password. No authentication or user interaction is required per the assessed vectors (PR:N/UI:N), and the absence of rate limiting and token expiration materially lowers the effort; CVE metadata scores this 9.2 under CVSS 4.0 and the independent assessment confirms high severity. No public exploit identified at time of analysis, but the vulnerable code path and affected version are publicly documented.
Authenticated back-office users of NivoCart (through 2.4.0) holding only view-only privileges can upload and execute arbitrary PHP, turning a low-privilege admin account into full remote code execution on the hosting web server. The flaw is in the File Manager multi() upload endpoint, which skips file-extension validation whenever a new filename is supplied or the chunks parameter is set to 2 or higher, letting a .php payload land in the web-accessible image/data/ directory where it can simply be requested. Exploitation requires a valid low-privileged back-office session and no non-default configuration, there is no CISA KEV entry and no public exploit identified at time of analysis, and the available data does not name an exact fixed version, so exposure hinges on whether an attacker already holds or can obtain a view-only admin account.
NivoCart through 2.5.1 emits the expected CAPTCHA answer directly into the HTML of protected public forms, so unauthenticated remote attackers can simply fetch the page, scrape the captcha_image value with a pattern match, and replay it to automate spam, fake registrations, bogus reviews, and account-deletion requests. Severity is moderate rather than critical: the independent assessment rates it CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only, no confidentiality or availability impact), consistent with the published CVSS 4.0 base score of 6.9, because the flaw yields no data disclosure, privilege gain, or code execution. No public exploit code, no CISA KEV listing, and no evidence of active exploitation were identified at time of analysis, and the real-world damage is bounded by the target's own handling of form submissions (e.g., mandatory email confirmation, review moderation).
Unauthenticated attackers can disable self-service password recovery in NivoCart through 2.4.0 by sending a GET request with a missing or invalid code parameter to the admin password-reset controller, causing the application to set config_password to 0. The impact is limited to a reversible denial of the password recovery feature; no authentication bypass, data exposure, or code execution occurs, and independent assessment rates this as low priority (CVSS 3.1 base 5.3). No public exploit identified at time of analysis.
NivoCart through 2.5.1 allows unauthenticated attackers to retrieve guest order invoices via the account/order download() action by iterating order_id values, exposing sensitive customer information such as names, addresses, telephone numbers, emails, purchased items, and order totals. The missing authorization check (CWE-862) affects installations that use guest checkout, as guest orders are stored with customer_id 0. No public exploit identified at time of analysis, though the enumeration is straightforward due to the lack of authentication requirements (CVSS PR:N).
Administrative account takeover in NivoCart through 2.4.0 is possible because the forgotten.php password-reset flow derives recovery codes from PHP's non-cryptographic mt_rand() and MD5, allowing unauthenticated remote attackers who know a valid administrator email address to predict or brute-force the 10-hex-character token and reset the administrator password. No authentication or user interaction is required per the assessed vectors (PR:N/UI:N), and the absence of rate limiting and token expiration materially lowers the effort; CVE metadata scores this 9.2 under CVSS 4.0 and the independent assessment confirms high severity. No public exploit identified at time of analysis, but the vulnerable code path and affected version are publicly documented.
Authenticated back-office users of NivoCart (through 2.4.0) holding only view-only privileges can upload and execute arbitrary PHP, turning a low-privilege admin account into full remote code execution on the hosting web server. The flaw is in the File Manager multi() upload endpoint, which skips file-extension validation whenever a new filename is supplied or the chunks parameter is set to 2 or higher, letting a .php payload land in the web-accessible image/data/ directory where it can simply be requested. Exploitation requires a valid low-privileged back-office session and no non-default configuration, there is no CISA KEV entry and no public exploit identified at time of analysis, and the available data does not name an exact fixed version, so exposure hinges on whether an attacker already holds or can obtain a view-only admin account.
NivoCart through 2.5.1 emits the expected CAPTCHA answer directly into the HTML of protected public forms, so unauthenticated remote attackers can simply fetch the page, scrape the captcha_image value with a pattern match, and replay it to automate spam, fake registrations, bogus reviews, and account-deletion requests. Severity is moderate rather than critical: the independent assessment rates it CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only, no confidentiality or availability impact), consistent with the published CVSS 4.0 base score of 6.9, because the flaw yields no data disclosure, privilege gain, or code execution. No public exploit code, no CISA KEV listing, and no evidence of active exploitation were identified at time of analysis, and the real-world damage is bounded by the target's own handling of form submissions (e.g., mandatory email confirmation, review moderation).
Unauthenticated attackers can disable self-service password recovery in NivoCart through 2.4.0 by sending a GET request with a missing or invalid code parameter to the admin password-reset controller, causing the application to set config_password to 0. The impact is limited to a reversible denial of the password recovery feature; no authentication bypass, data exposure, or code execution occurs, and independent assessment rates this as low priority (CVSS 3.1 base 5.3). No public exploit identified at time of analysis.