Description
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nivocart nivocart
Default version status: unaffected
0 to ≤ 2.5.1affected
pkg:composer/nivocart/nivocartReferences
- https://github.com/nivocart/nivocart/issues/26 ↗
- https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/account/order.php#L695-L770 ↗
- https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/model/account/order.php#L11-L12 ↗
- https://github.com/nivocart/nivocart ↗
- https://www.vulncheck.com/advisories/nivocart-through-2.5.1-guest-order-invoice-disclosure-via-account-order-download ↗