Shopify · Report #237597
SQL Exception thrown during product import
Validstatus
mediumseverity
14upvotes
12 Jul 2017disclosed
Summary
The researcher reported an issue where in certain cases product imports would send notification emails with full MySQL error messages. In this case, the error reported was caused by a timeout unrelated to the file uploaded by the researcher and didn't contain any sensitive information. The issue has been fixed and notification emails no longer show full MySQL error messages.
How it was found
Possible SQL Injection was observed when a descriptive error message was thrown in a mail sent to the user while importing products from csv. Used some special characters in csv to induce the error.
DATABASE FOUND TO BE MYSQL.
{F192274}