POJIA破甲
地图 / any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store

any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store

访问控制 / 访问控制缺陷(通用) / #629150

厂商
Shopify
严重程度
低危
赏金
—
弱点
访问控制缺陷(通用)
研究员
@modam3r5
披露日期
2019-07-15
资产
your-store.myshopify.com
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(5685 字符中的一小部分)
I found this cool behavior by mistake when I was testing for some `GraphQL`, any user have ability to comment in `discounts code ` at discounts section can turn off comments to the other staff members include the admin/manager of the store. this happens because when the `GraphQL` used to create a …
原文中的代码
{"errors":
[
{"message":"Internal error. Looks like something went wrong on our end.\nRequest ID: d8358e69-631c-45a7-929b-630b9abf8b5c (include this in support requests)."}
]
}

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Shopify 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @modam3r5 · 版权归作者与 Shopify 所有

同类报告

Account Takeover via Password Reset without user interactionsGitLab · 2025-02-26 · $35,000Exfiltrate and mutate repository and project data through injected templated serviceGitLab · 2019-03-05 · $11,000Getting all the CD keys of any gameValve · 2018-10-31 · $20,000Ability to reset password for accountUpserve · 2019-06-06Publicly accessible Continuous Integration ToolSnapchat · 2021-07-29One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · 2022-08-02