Description
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nivocart nivocart
Default version status: unaffected
0 to ≤ 2.4.0affected
pkg:composer/nivocart/nivocartReferences
- https://github.com/nivocart/nivocart/issues/25 ↗
- https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/forgotten.php#L20-L34 ↗
- https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123 ↗
- https://github.com/nivocart/nivocart ↗
- https://www.vulncheck.com/advisories/nivocart-through-2.4.0-predictable-administrator-password-reset-token ↗