Description

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-20T12:17:05.940Z",
  "pubdate": "2026-09-20T12:17:05.940Z",
  "executiveSummary": "NivoCart versions up to and including 2.4.0 contain a critical configuration write vulnerability within the password recovery mechanism. The flaw allows unauthenticated remote attackers to modify core system settings, specifically the 'config_password' parameter, by submitting an invalid or missing 'code' argument to the password reset controller.\nThe vulnerability effectively acts as a denial-of-service vector for the password recovery service. By triggering a configuration rewrite, an attacker can set the password recovery flag to '0', rendering the self-service password reset functionality inoperative. This requires manual administrative intervention to restore, causing service degradation and potential account lockout scenarios.\nThis vulnerability is particularly severe because it requires zero authentication, permitting any network-based attacker to manipulate site-wide security configurations. The simplicity of the exploitation—a single crafted GET request—places this issue at a high risk level for deployments using default or publicly accessible configurations.",
  "technicalDetails": "The vulnerability resides within the admin password reset controller of NivoCart, which fails to adequately sanitize or validate input parameters processed during the password recovery workflow. The root cause of this security flaw is an insecure implementation of configuration state management, where the application's configuration file or database settings are updated directly based on user-supplied input without proper authorization or integrity checks.\nThe attack flow begins when an attacker identifies the password reset controller path. By sending a maliciously crafted HTTP GET request, the attacker purposefully supplies a missing or malformed 'code' parameter, which is intended to serve as a cryptographic or time-sensitive token to verify a legitimate password reset request. Due to the lack of server-side validation for this parameter, the application logic proceeds to process the request context.\nIn the vulnerable code path, the application erroneously interprets the absent or invalid 'code' parameter as a signal to update the system configuration. Specifically, the 'config_password' setting is updated to a value of '0' in the configuration storage mechanism. This action is performed with the authority of the web application's service account, bypassing any required administrative session context.\nThe payload behavior is strictly destructive to the availability of the application. Upon successful execution, the 'config_password' setting is disabled, which forces the password recovery module to cease operation. Because this change is persistent, the service remains unavailable until an authorized administrator manually edits the underlying configuration files or database tables to revert the value to its intended functional state.\nThis vulnerability is categorized as an improper access control issue leading to unauthorized configuration modification. It is exposed over the network, allowing exploitation by any remote entity capable of reaching the web server. Since the application fails to distinguish between a legitimate reset process and an malformed probe, the security boundary of the administrative configuration is effectively bypassed."
}