Low Privileged Staff Member Can Export Billing Charges
访问控制 / 访问控制缺陷（通用） / #1010835
该报告还没有中文解读。
原文摘录
摘自原文（2054 字符中的一小部分）
Details I'm not 100% sure about this because i don't have billing transactions on my account. However, from my experience on how Shopify backend respond, i think this is a valid finding just need confirmation from Shopify's security team. A GraphQL mutation `billingChargesExport` can be used by a …
原文中的代码
POST /admin/internal/web/graphql/core HTTP/1.1
Cookie: [REDACTED]
accept: application/json
X-CSRF-Token: [REDACTED]
Content-Type: application/json
User-Agent: PostmanRuntime/7.26.5
Host: [YOUR-SHOP].myshopify.com
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 303
{"query":"\r\n …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @ash_nz · 版权归作者与 Shopify 所有