Description
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nivocart | nivocart | ≤ 2.4.0 | — |
References
- GitHub Issue #25 issue-tracking
- reset.php failure branch at v2.4.0 technical-description
- getUserByCode at v2.4.0 technical-description
- https://github.com/nivocart/nivocart product
- VulnCheck Advisory: NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller third-party-advisory