CVE-2025-51605: High severity Shopizer Shopizer vulnerability
An issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client-supplied Origin header verbatim into Access-Control-Allow-Origin without any whitelist validation, while also enabling Access-Control-Allow-Credentials: true. This allows any malicious origin to make authenticated cross-origin requests and read sensitive responses.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-51605?
CVE-2025-51605 is considered a critical vulnerability due to its potential for unauthorized access and credential theft.
How do I fix CVE-2025-51605?
To fix CVE-2025-51605, implement proper CORS policies by validating the Origin header against a whitelist before inclusion in the Access-Control-Allow-Origin response.
What are the potential impacts of CVE-2025-51605?
The potential impacts of CVE-2025-51605 include unauthorized access to sensitive user data and exploitation of user sessions by attackers.
Which versions of Shopizer are affected by CVE-2025-51605?
CVE-2025-51605 affects Shopizer version 3.2.7.
Is there a known exploit for CVE-2025-51605?
Yes, there is a known proof of concept that demonstrates the exploitability of CVE-2025-51605.