XSS at Bulk editing ProductVariants

Disclosed: 2015-06-25 04:12:57 By mafia To shopify
Unknown
Vulnerability Details
Steps to Reproduce: 1.Create a Product with Title and Description as ` "><img src=x onerror=prompt(133)>` 2. Now goto https://blahblah.myshopify.com/admin/products/inventory 3. Select the Product created at Step 1 and Click on Edit variants and XSS will be triggered
Actions
View on HackerOne
Report Stats
  • Report ID: 72331
  • State: Closed
  • Substate: resolved
  • Upvotes: 2
Share this report