Shopify · Report #93921
Unauthorized access to all collections, products, pages from other stores
Validstatus
$2,500bounty
6upvotes
20 Oct 2015disclosed
Summary
This bug allowed users from one store to read the name of collections, products and pages from other stores. It would have allowed anyone to discover the name of hidden collections, products and pages from other stores, but not retrieve any other information about the collection, product or page, and it would not have allowed the user to determine which store it belongs to.
How it was found
Hi
I found a vulnerability in shopify that can leak other shops hidden objects include collection,product,page,blog
steps:
- go to "/admin/link_lists"
- click on "add link list"
- select one object from list for example collection
- open "Inspect Element"
- change value of element "link_list[links][][subject_id]" to any id from other shops
- click on save then when page reloaded you will see data in box
this works for hidden collection, products, pages
Regards