Lucene search

K
hackeroneAnalyst_securityH1:978125
HistorySep 10, 2020 - 4:06 a.m.

Shopify: xss triggered in "myshopify.com/admin/product"

2020-09-1004:06:27
analyst_security
hackerone.com
192

I tried to make a product description and add the xss script in the paragraph.

steps for reproduction

  1. create a new product
  2. enter xss in the product description paragraph, such as;
    `<div> <img src>
    <h4> <span> <em> <strong> (name_product) </strong></em></span> </h4>
    </div> ``

Impact

xss can be triggered