HexBrain

Shopify · Report #58630

Content Spoofing

Validstatus
9upvotes
5 May 2015disclosed

How it was found

Hi, Content Spoofing almost all in the myshopify admin account. Content Spoofing an attack technique used to trick a user into thinking that fake web site content is legitimate data.

https://[YOURSHOP].myshopify.com/admin?error=CONTENT SPOOFING

https://[YOURSHOP].myshopify.com/admin/orders?error=CONTENT SPOOFING

https://[YOURSHOP].myshopify.com/admin/products?error=CONTENT SPOOFING

https://[YOURSHOP].myshopify.com/admin/customers?error=CONTENT SPOOFING

https://[YOURSHOP].myshopify.com/admin/reports?error=CONTENT SPOOFING

https://[YOURSHOP].myshopify.com/admin/discounts?error=CONTENT SPOOFING

https://[YOURSHOP].myshopify.com/admin/dashboard/online?error=CONTENT SPOOFING

https://[YOURSHOP].myshopify.com/admin/apps?error=CONTENT SPOOFING

https://[YOURSHOP].myshopify.com/admin/settings/general?error=CONTENT SPOOFING

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original