Description

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-20T12:17:06.277Z",
  "pubdate": "2026-09-20T12:17:06.277Z",
  "executiveSummary": "NivoCart through version 2.4.0 is susceptible to a critical authentication bypass vulnerability due to the implementation of insecure pseudo-random number generation during the password recovery process.\nThe vulnerability resides within the forgotten.php endpoint, which generates password reset tokens using predictable entropy sources. This flaw allows unauthorized actors to reliably generate valid reset tokens for any registered administrator account.\nBy successfully predicting these tokens, an attacker can bypass standard authentication mechanisms, force a password reset, and achieve full administrative account takeover.\nThe risk is exacerbated by the absence of rate-limiting controls and the lack of token expiration, enabling an attacker to conduct brute-force or pre-computation attacks with a high probability of success.\nThis vulnerability poses a severe threat to the integrity and confidentiality of the application, as administrative access grants total control over the platform's data and configuration.",
  "technicalDetails": "The vulnerability is rooted in the insecure use of the mt_rand() function as the entropy source for password reset token generation within the forgotten.php script.\nIn PHP, mt_rand() implements the Mersenne Twister algorithm, which is a cryptographically insecure pseudo-random number generator (PRNG). When used without adequate seeding, the output of mt_rand() is deterministic and predictable if an attacker can observe or infer the internal state of the generator.\nThe implementation specifically utilizes the substr(md5(mt_rand()), 0, 10) pattern to generate the 10-character reset token. Because the seed space for mt_rand() is limited and the generation process relies on a non-cryptographic PRNG, an attacker can theoretically reproduce the same output sequence.\nThe attack flow proceeds as follows: First, the attacker identifies a target administrative email address. Second, the attacker triggers the password reset mechanism via the forgotten.php endpoint. Third, because the application does not enforce rate limiting or implement time-based token expiration, the attacker can leverage the predictability of the PRNG to generate a collection of candidate tokens.\nBy matching the expected output format against the predictable nature of the MD5 hashing of the PRNG output, the attacker can systematically validate reset tokens. Once a token is successfully guessed, the attacker submits it to the application, which authorizes a password update for the target administrator account.\nBecause the reset tokens do not expire, an attacker has an indefinite window to perform these calculations, significantly increasing the reliability of the exploit.\nThis vulnerability represents a complete bypass of the administrative authentication workflow, requiring no prior authentication or specialized privileges to initiate the reset process. The attack is fully executable over the network, making it a critical risk for internet-facing NivoCart deployments.\nPost-exploitation impact includes unauthorized administrative access, allowing for the modification of store settings, exfiltration of customer data, and the potential execution of further malicious activities through administrative functions."
}