Shopify · Report #101450
XSS in creating tweets
Validstatus
3upvotes
3 Dec 2015disclosed
How it was found
Hi, I found an XSS while tweeting my product. To reproduce:
- Create new tweet.
- Select any product.
- Input in message content `"><img src=x onerror=alert(document.domain)>
- XSS executes.
- Hit Publish. XSS also executes.
Cheers!