Shopify · Report #72331
XSS at Bulk editing ProductVariants
Validstatus
$500bounty
2upvotes
25 Jun 2015disclosed
How it was found
Steps to Reproduce:
1.Create a Product with Title and Description as "><img src=x onerror=prompt(133)>
2. Now goto https://blahblah.myshopify.com/admin/products/inventory
3. Select the Product created at Step 1 and Click on Edit variants
and XSS will be triggered