Executive brief
NivoCart is a shopping cart system for small and medium-sized businesses. An attacker who knows an administrator's email address can request a password reset and easily predict the recovery token to hijack the admin account, gaining full control of the e-commerce platform and access to customer data and payment information.
Technical details
The forgotten.php endpoint generates password reset tokens using substr(md5(mt_rand()), 0, 10), which produces a weak 10-character hex string that can be efficiently brute-forced or predicted due to weak random number generation (mt_rand is not cryptographically secure). The vulnerability requires knowledge of the target email address but has no rate limiting or token expiration, allowing unauthenticated attackers to enumerate valid reset codes. A patch is available in newer versions.
Affected products
- NivoCart NivoCart through 2.4.0
Timeline
- 2026-09-20: disclosed