Open on HackerOneSign in

Shopify · Report #73566

Reflected XSS in chat

Validstatus

2upvotes

11 Aug 2015disclosed

How it was found

https://livechat.shopify.com/customer/chats/new?chat%5Bemail%5D=mymail%40mail.com&chat%5Bname%5D=My+Name&utm_source=partner&chat%5Btags%5D=123%27%5D%29;alert%281%29;//&chat%5Bmetadata%5D%5Bshop_id%5D=90909090%22

Vulnerable param is chat[tags]. If fill it with 123']);alert(1);// the XSS fill fire after click "Start chat@ button (screen).

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original