CORS vulnerability

The vulnerability is a mechanism for accessing data of other origins through AJAX[1] requests. Sites use CORS to bypass the SOP[2] and access other ORIGIN resources. If CORS is not implemented properly, the hacker can send a request to the target (for example, APIs) and introduce itself as a valid ORIGIN and access specific target resources. With this vulnerability, a Credential series can be stolen from the target site or CSRF[3] attacks can be scripted. Perform CORS vulnerability testing on domain.com: 1 - Consider a path such as domain.com/wp-json. 2 - We receive the request through BURP SUITE[4]. 3 - I add the parameter (origin: attacker.com) to the header section of the request. 4 - If our data showed and was in response to the following statements, it means that there is a vulnerability Sample output : Access-control-Allow-origin: https://attacker.com Access-control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE. ....... Access-control-Allow-Credentials: true A....