Predictable Password Reset Token in NivoCart

Executive Summary

NivoCart through version 2.4.0 has a predictable password reset token vulnerability in the forgotten.php endpoint. It generates recovery codes using substr(md5(mt_rand()), 0, 10), which makes tokens predictable. Attackers who know an administrator's email can request a password reset and guess the token to gain admin access without rate limits or expiration.

Useful 0 Not Useful 0

Detection Guidance

Check if NivoCart version 2.4.0 or earlier is installed. Inspect the forgotten.php endpoint for password reset token generation using substr(md5(mt_rand()), 0, 10). Review admin email exposure in error messages and absence of rate limiting or token expiration.

Useful 0 Not Useful 0

Impact Analysis

If you are an administrator using NivoCart <= 2.4.0, attackers can exploit this to gain full administrative access to your system. This could lead to data theft, unauthorized modifications, or complete system compromise. Even if you are not an admin, if you use this software, your data could be at risk through admin account takeover.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires adequate security measures to protect personal data, and HIPAA mandates strict access controls for protected health information. The lack of secure password reset tokens and potential unauthorized admin access could result in non-compliance, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NivoCart to the latest version beyond 2.4.0. Replace the weak token generation with a cryptographically secure random method. Implement rate limiting and token expiration for password resets. Add CSRF protection to the forgotten.php endpoint.

Useful 0 Not Useful 0