Register & login with any user. Visit cart page but with id=1: https://shoe-shop-1.ctf.zone/index.php?page=cart&id=1. The cart belongs to the admin and shows the flag.
Solved!