NivoCart Missing Authorization in Order Download

Executive Summary

NivoCart through version 2.5.1 has a missing authorization vulnerability in the download function of account/order. Unauthenticated attackers can exploit this by providing an order_id to retrieve guest order invoices. By iterating the order_id parameter, attackers can access guest orders associated with customer_id 0, exposing sensitive data such as guest names, addresses, phone numbers, emails, purchased items, and order totals.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the /account/order/download endpoint for unauthenticated access attempts with order_id parameters. Check server logs for repeated requests with varying order_id values, especially those matching guest orders (customer_id 0).

Use tools like curl to test if the endpoint leaks sensitive data without authentication. Example: curl -v http://<target>/account/order/download?order_id=123

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to steal sensitive personal and financial information from guest orders. If you or your customers have placed orders as guests, their data including names, addresses, contact details, and purchase history could be exposed. This could lead to identity theft, fraud, or targeted phishing attacks against affected individuals.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR as it involves unauthorized access to personal data of EU residents. It may also breach HIPAA if protected health information was exposed in order details. Organizations could face regulatory fines, legal liabilities, and reputational damage for failing to protect sensitive customer data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update NivoCart to the latest version beyond 2.5.1. If an update is unavailable, restrict access to the /account/order/download endpoint via firewall rules or web server configuration.

Implement authentication for the download() action and validate user permissions before processing order_id requests. Review server logs for past exploitation attempts.

Useful 0 Not Useful 0