# Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation

Shopify Chat order lookup accepted SQL-like 'OR' payloads in order_number, letting anyone fetch a customer's first order or enumerate orders by email.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-11-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1017576
- Library page: https://bugbountylibrary.com/r/h1%3A1017576
- Tags: area:web3 domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium technique:param-pollution vuln:access-control vuln:idor vuln:sqli

**Target:** Shopify Chat storefront order_lookup API endpoint
**Root cause:** The order_number parameter is passed unsanitized into a lookup query, so '1 OR 2' or chained OR clauses match arbitrary orders instead of the exact number.
**Steps:**
1. Install Shopify Chat with OrderLookup on a shop; open `https://{shop}.myshopify.com/?chat`
2. Trigger 'I need an update on my order' -> 'Enter order information' and submit any email/number
3. Intercept `POST https://shopify-chat.shopifycloud.com/api/storefront/conversations/{id}/order_lookup` with body `{"order_lookup":{"email":"...","order_number":"1000"}}`
4. Set email to victim and order_number to `1 OR 2` to get victim's first order link
5. Set order_number to `1000 OR 1001 OR ... OR 1005` to enumerate; remove matched number and resend for next
**How found:** Noticed lookup only needs email+order number and returns an order status link; fuzzed both parameters and observed OR payloads matched unintended orders.
**Exploitation:** Replay the intercepted order_lookup request with a victim email and an OR-injected order_number; the response returns the order status page link for the first matching order, enabling enumeration by iterating.
**Escalation:** Chained OR clauses (tested ~50 numbers) to enumerate multiple orders per request.
**Insight:** Order-lookup widgets that return a status-page link are a good target: try injecting boolean/OR logic into the order_number field to bypass exact-match and enumerate per-email orders.