Attack Chain

1. Attacker gains unauthorized or low-privileged access to the NivoCart back-office panel.
2. Attacker navigates to the File Manager component.
3. Attacker initiates an upload request to the multi() endpoint.
4. Attacker manipulates the request to set the chunks parameter to a value of 2 or higher.
5. Attacker uploads a malicious PHP file, bypassing extension validation checks.
6. The application saves the malicious file into the web-accessible image/data/ directory.
7. Attacker requests the uploaded file directly via a web browser to execute the payload.
8. Web server processes the PHP code, granting the attacker remote code execution.

Impact

Successful exploitation of this vulnerability allows an unauthenticated or low-privileged attacker to achieve remote code execution on the target server. This could lead to a full system compromise, data theft, unauthorized modification of site content, and potential lateral movement within the network. All NivoCart installations at or below version 2.4.0 are affected.

Recommendation

1. Immediately restrict access to the NivoCart back-office panel to authorized personnel only to mitigate the impact of the required low-level access.
2. Monitor web server access logs for anomalous POST requests to the File Manager multi() endpoint, specifically tracking requests containing the chunks parameter.
3. Implement egress filtering on the web server to prevent post-exploitation activity such as reverse shells or data exfiltration.
4. Periodically audit the image/data/ directory for unauthorized script files (e.g., .php files) that should not be present in an image storage folder.
5. Upgrade NivoCart to a version beyond 2.4.0 once the vendor provides a patch to address the underlying validation flaw in the File Manager.