Shopify: Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation
It came to my attention that the Shopify Chat application allows a customer to retrieve its order status by only providing the order email and number. Noticing that it results in being provided the order status page link, I started playing a bit with both parameters and I found out that it is...