A predictable token generation flaw in NivoCart versions through 2.4.0 allows unauthenticated attackers to hijack administrative accounts.

The application utilizes a cryptographically weak pseudo-random number generator, specifically mt_rand(), to generate password reset tokens in the forgotten.php endpoint. This allows an unauthenticated attacker who knows an administrator's email address to predict the reset token and reset the password, effectively gaining full administrative control of the application.

Successful exploitation of this vulnerability results in full administrative access to the NivoCart application. This compromise allows an attacker to manipulate site content, access sensitive user data, and potentially execute further malicious actions within the environment. With a CVSS score of 8.1, this represents a high-severity risk that could lead to significant reputational damage and data breaches.

Immediate Action: There is currently no official patch available; administrators should restrict access to the forgotten.php endpoint at the web server level to prevent unauthorized requests.

Proactive Monitoring: Review web server and application access logs for repeated, suspicious requests to the forgotten.php endpoint, especially those originating from unusual IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or rate-limit requests to the reset password functionality, which can help mitigate automated brute-force attempts to guess tokens.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the critical nature of administrative account security, this vulnerability presents a significant risk to the integrity of the NivoCart platform. Administrators must prioritize limiting access to the vulnerable endpoint and monitor for signs of unauthorized account recovery attempts until a vendor-supplied patch is made available.