Shopify · Report #975047
User sensitive information disclosure
Validstatus
mediumseverity
$1,000bounty
40upvotes
22 Oct 2020disclosed
How it was found
1、open shopify指南 Applets 2、click 个人中心 3、click 编辑资料 (微信图片_20200905123248.png) 4、https://api-wechat.shopify.cn/api/sp/customer/id (1.png) 5、Modify the ID value to traverse the user information
Impact
User sensitive information disclosur