Description
NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nivocart | nivocart | ≤ 2.4.0 | — |
References
- GitHub Issue #25 issue-tracking
- multi() upload path at v2.4.0 technical-description
- duplicated file manager controller at v2.4.0 technical-description
- https://github.com/nivocart/nivocart product
- VulnCheck Advisory: NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager third-party-advisory