Shopify · Report #81757
Reflected XSS in chat.
Validstatus
4upvotes
2 Sept 2015disclosed
Summary
XSS in chat http://livechat.shopify.com/ with file not allowed to upload
How it was found
hello login in the chat and upload file with Payload name (code injection) like <img src="c" onerror=alert(1)> the code html will execute
<span>You are not allowed to upload '<img src="c" onload="alert(1)">' files, allowed types: jpg, jpeg, gif, png</span>
Hadji Samir