Shopify · Report #117449
XSS in Draft Orders in Timeline i SHOPIFY Admin Site!
Validstatus
7upvotes
28 Jul 2016disclosed
How it was found
- Create an Draft with a product named "><img src=x onerror=prompt('XSSP')
- Send the Draft to someone and complete the order. Order is shown as Completed Drafts as order.png
- Create a timeline and reference this Draft. As soon as you click POST you will be XSSEd (xss.png)
Thanks