NivoCart v2.4.0 Vulnerability Report: RCE via Arbitrary File Upload & Unauth Logic Flaws

NivoCart v2.4.0 Security Vulnerability Report Summary Vulnerability Overview Scope of Impact Target Version: NivoCart 2.4.0 (commit , master branch) Scope: Limited to source code review and local verification; public or hosted instances were not tested. Disclosure Policy: Responsible disclosure, allowing maintainers time to implement fixes. Vulnerability Details NC-01: Remote Code Execution (RCE) via Arbitrary File Upload in File Manager Location: (line 552) and (line 574) CWE: CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-862 (Missing Authorization) Description: The function allows the direct upload of executable files (e.g., ) to the directory, which is web-accessible and lacks server-level execution controls. Bypass Logic Deficiencies: 1. Conditional extension check: Extension filtering is only evaluated if the file already exists in the file system. 2. Chunk parameter bypass: The check is gated by , allowing validation to be bypassed by submitting a value of ≥2. 3. Missing permission validation: does not verify . 4. No execution restrictions on target path: The directory lacks a file to block PHP execution. Impact: An authenticated user with file manager access can upload arbitrary executable scripts, achieving code execution in the context of the web server process. Remediation: - Strictly and unconditionally validate file extensions and MIME types before saving files or chunks. - Add an explicit check at the beginning of . - Add web server configuration to deny script execution (e.g., a file in ). NC-02: Unauthenticated Permanent Disabling of Admin Password Recovery Location: (lines 93-96) CWE: CWE-657 (Violation of Secure Design Principles) Description: When an invalid or missing reset code is provided, the controller executes logic setting to 0. Since is in the unauthenticated whitelist, any visitor can trigger this by sending a request without a valid code. Impact: Once is set to 0, and immediately redirect to the login page. Administrators are locked out of self-service recovery until the database is manually updated or a backup is restored. Remediation: Remove the database update logic from the failure branch. Invalid or missing codes should only return an error notification or redirect to the login page. NC-03: Weak PRNG and Password Reset Tokens Without Expiration Location: (line 24) and (line 119) CWE: CWE-338 (Use of Cryptographically Weak PRNG), CWE-330 (Use Insufficiently Random Values) Description: Admin password reset tokens are constructed using . is not a cryptographically secure random number generator, and truncating to a 10-digit decimal number results in low entropy. Tokens are stored in the database without expiration timestamps, and only requires the token to be non-empty, allowing indefinite use. Impact: An attacker targeting known administrator email addresses may predict or brute-force active recovery tokens. Remediation: - Use to generate tokens. - Record creation timestamps and set an expiration time (e.g., 30-60 minutes). - Implement rate limiting for token request and redemption operations. NC-04: Missing Authorization Check in "Login as Customer" Feature Location: (line 1251, ) CWE: CWE-862 (Missing Authorization) Description: The operation generates a temporary login token and redirects to the frontend, authenticating as the specified customer. However, while other operations in this controller (e.g., ) verify permissions, does not check . Impact: Any administrator allowed to view the customer management screen can impersonate any registered customer account without restriction. Remediation: Add a permission check at the beginning of : NC-05: Latent SQL Injection in SEO URL Handler Location: (line 136) CWE: CWE-89 (SQL Injection) Description: The parameter is directly concatenated into the database query without escaping. Impact: The current code uses as a mitigation, but the lack of parameterized queries or escaping at the call site constitutes a weakness in defense-in-depth. Remediation: Apply appropriate query escaping. Code Snippets Vulnerable code for NC-05: Suggested fix code for NC-05: Suggested fix code for NC-04: Related code for NC-02 (in ): Recommended Fix Priority 1. NC-01 (High): Implement permission checks, unconditional extension validation, and disable script execution. 2. NC-02 (Medium): Remove the side-effect of configuration modification. 3. NC-03 (Medium): Upgrade password reset token generation to CSPRNG and add expiration timestamps. 4. NC-04 (Medium): Restrict customer impersonation to users with modify permissions. 5. NC-05 (Low): Ensure consistent use of in all queries.

Goal Reached Thanks to every supporter — we hit 100%!

NivoCart v2.4.0 Vulnerability Report: RCE via Arbitrary File Upload & Unauth Logic Flaws

More from this source