Shopify · Report #971599
damage to the timeline so that comment fields cannot be displayed or not available to all members in the store
Validstatus
8upvotes
9 Sept 2020disclosed
How it was found
see https://a-alert-b-y000-b-finda.myshopify.com/admin/discounts/416981811222
I tried to make a discount code with a product name and a discount code like: ± <img src = x onerror = alert (1)> ±
when I havehtag (#) the product name on the timeline (comment) and I get a "server error" reply and it causes crashes to the timeline, so comments are automatically inactive or non-existent.
This can be done by members who want to destroy the shop, so that all members of the shop feel the impact.
step for reproduction
- create a product name and discount code using a payload like: ± <img src = x onerror = alert (1)> ±
- Product name hashtags in the timeline
- The comment field cannot be displayed
Impact
The comment field cannot be displayed