Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation

其他弱点 / Unlabeled / #1017576

厂商

Shopify

严重程度

未评级

赏金

—

弱点

Unlabeled

研究员

@imgnotfound

披露日期

2020-11-19

资产

your-store.myshopify.com

CVE

—

该报告还没有中文解读。

It came to my attention that the Shopify Chat application allows a customer to retrieve its order status by only providing the order email and number.

{
	"order_lookup":
	{
		"email": "[email protected]",
		"order_number":"1000"
	}
}