HexBrain
Open on HackerOneSign in

Shopify · Report #71614

XSS in Myshopify Admin Site in DISCOUNTS

Validstatus
2upvotes
20 Jul 2015disclosed

How it was found

POC

  1. Go to Customers and add a new search group named "><img src=x onerror=prompt(7) See creategroup.png
  2. Go to Discounts and add a Discount Code based on Customer group and choose the one created above
  3. Click Save

XSS in discounts occur (discountxss.png)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original