Shopizer is vulnerable to CWE 613-Insufficient Session Expiration

[menghaining]

Description

In version 3.2.5, Shopizer is vulnerable to Insufficient Session Expiration.
When a customer/user who was already logged in is deleted, the customer/user will still have access to the application even after he is deleted.

Attack Vector

1. admin login, user1/customer1 login.
2. admin delete user1/customer1 through "/api/v1/private/customer/{id}" or "/api/v1/auth/customer/" or "/api/v1/private/user/{id}", {id} refers to the user1/customer1's identifer.
3. user1/customer1 still active, and can still operate.

similar: https://nvd.nist.gov/vuln/detail/CVE-2022-23063