HexBrain

Shopify · Report #72331

XSS at Bulk editing ProductVariants

Validstatus
$500bounty
2upvotes
25 Jun 2015disclosed

How it was found

Steps to Reproduce:

1.Create a Product with Title and Description as "><img src=x onerror=prompt(133)> 2. Now goto https://blahblah.myshopify.com/admin/products/inventory 3. Select the Product created at Step 1 and Click on Edit variants

and XSS will be triggered

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original