Shopify · Report #887879
xss stored in https://your store.myshopify.com/admin/
Validstatus
lowseverity
$1,000bounty
46upvotes
24 Aug 2020disclosed
How it was found
hello , i fond xss stored in https://your store.myshopify.com/admin/ steps ;
- go to
https://swqdewd.myshopify.com/admin/menus/new - click in Add menu item
- add name
"><img src="x" onerror="alert(document.cookie)">AND any link - now click add
- click in remove item
- alert
- watch the vedio poc for more information
Impact
xss attack .....