Executive brief
NivoCart is a PHP-based shopping cart system used by small and medium businesses to manage online sales. An unauthenticated attacker can disable password recovery by sending a request with an invalid code to the admin password reset function, which overwrites a configuration setting that controls self-service password recovery. This prevents administrators and users from resetting forgotten passwords until a site administrator manually re-enables the feature, potentially locking legitimate users out of their accounts.
Technical details
The admin password reset controller fails to validate the reset code parameter before processing it, allowing an unauthenticated GET request with a missing or malformed code to trigger a config write that sets config_password to 0. The vulnerability exists in the reset.php controller which checks if a user exists for the given code but proceeds to disable password recovery on invalid input. An attacker needs only network access to the admin password reset endpoint; no authentication or user interaction is required.
Affected products
- NivoCart NivoCart through 2.4.0
Timeline
- 2026-09-20: disclosed