Shopizer CORS Vulnerability Allowing Authenticated Cross-Origin Requests in Version 3.2.7

A vulnerability in Shopizer version 3.2.7 exists due to the server's Cross-Origin Resource Sharing (CORS) implementation, which reflects the client-supplied Origin header directly into the Access-Control-Allow-Origin response header without any validation against a whitelist. Additionally, the server allows Access-Control-Allow-Credentials: true, enabling any malicious origin to make authenticated cross-origin requests and access sensitive responses.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information by allowing malicious origins to make authenticated requests and read protected data.