HexBrain

Shopify · Report #117449

XSS in Draft Orders in Timeline i SHOPIFY Admin Site!

Validstatus
7upvotes
28 Jul 2016disclosed

How it was found

  1. Create an Draft with a product named "><img src=x onerror=prompt('XSSP')
  2. Send the Draft to someone and complete the order. Order is shown as Completed Drafts as order.png
  3. Create a timeline and reference this Draft. As soon as you click POST you will be XSSEd (xss.png)

Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original