A critical arbitrary file upload vulnerability in NivoCart allows authenticated users with back-office access to achieve remote code execution.

The vulnerability exists within the File Manager multi() endpoint, which fails to properly validate file extensions when handling new filenames or multi-part uploads. An attacker with standard view-only back-office privileges can bypass these checks to upload and execute malicious PHP scripts within the web-accessible image/data/ directory.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary code on the underlying web server, potentially leading to a full compromise of the application and its hosted data. Given the CVSS score of 8.8, this flaw poses a high risk to the confidentiality, integrity, and availability of the system. Organizations may face severe consequences, including unauthorized access to sensitive business information and the potential for lateral movement within the network.

Immediate Action: As no specific patch version is currently identified, administrators should restrict back-office access to only trusted users and monitor the image/data/ directory for unauthorized PHP or executable files. Contact the vendor for official guidance or emergency security updates.

Proactive Monitoring: Review web server access logs for requests directed at the image/data/ directory, specifically looking for attempts to access or execute files with non-image extensions. Monitor system file integrity to detect unexpected new files in the application directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block POST requests to the File Manager endpoint that contain suspicious file extensions or anomalous chunked upload parameters. Ensure the web server configuration prevents the execution of scripts within the uploads directory.

Public Exploit Available: No (exploit_available: false)

The severity of this remote code execution flaw requires immediate attention to prevent potential system compromise. Administrators must prioritize limiting access to the administrative dashboard and implementing strict file validation controls at the network edge while awaiting a formal vendor patch.