HexBrain

Shopify · Report #887879

xss stored in https://your store.myshopify.com/admin/

Validstatus
lowseverity
$1,000bounty
46upvotes
24 Aug 2020disclosed

How it was found

hello , i fond xss stored in https://your store.myshopify.com/admin/ steps ;

  1. go to https://swqdewd.myshopify.com/admin/menus/new
  2. click in Add menu item
  3. add name "><img src="x" onerror="alert(document.cookie)"> AND any link
  4. now click add
  5. click in remove item
  6. alert
  7. watch the vedio poc for more information

Impact

xss attack .....

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original