Predictable Password Reset Tokens Enable Admin Account Takeover

NivoCart versions through 2.4.0 contain a critical authentication bypass vulnerability in the forgotten.php endpoint that generates password reset tokens using a weak randomization method: substr(md5(mt_rand()), 0, 10). This vulnerability (CWE-338: Use of Insufficiently Random Values) allows attackers to predict recovery codes with minimal computational effort. An attacker who knows an administrator's email address can request a password reset, calculate the likely token value, and gain full administrative access to the e-commerce platform without triggering rate limiting protections or relying on token expiration. This directly impacts NivoCart deployments and represents a complete compromise of account security controls, enabling lateral movement, data theft, and malicious modifications to product catalogs or customer data.

While this specific CVE currently lacks mapped MITRE ATT&CK techniques, Casky's extended reasoning capabilities would detect the underlying attack patterns through reconnaissance and credential access behaviors. Practitioners using Casky would observe indicators such as multiple failed authentication attempts followed by successful admin logins from anomalous sources, unusual account recovery requests concentrated around administrator accounts, or suspicious login activities immediately after password reset requests. Although Casky's current skill library (0 direct matches for this CVE) doesn't include specialized detections for mt_rand() prediction patterns, security teams can leverage Casky's reasoning engine to correlate weak cryptographic implementations with Credential Access techniques (MITRE T1110 family) and develop custom detection rules by analyzing authentication logs for timing anomalies and token reuse patterns that would indicate automated token prediction attempts.