Shopify · Report #263876
Stored XSS Deleting Menu Links in the Shopify Admin
Validstatus
mediumseverity
35upvotes
8 Sept 2017disclosed
Summary
The researcher found that menu titles were being rendered without proper escaping in the admin area. Unlike many other XSS reports we typically receive, this one has its payload excluded in a way that is not excluded in our program page's exclusion list.
How it was found
Hello Team,
I found a stored xss issue.
PoC (unlisted): https://youtu.be/MjnKyFgqTTo
watch my PoC than you'll understood everything.
Payloads: // # "><svg/onload=prompt(1)>
Looks Like this issue available at " Title in Add menu " and also available at "Title" in " Menu Item "
Mirror: https://azizvai.myshopify.com/
Thanks