# Stored XSS in Discounts section

Product name with an img onerror payload was stored unescaped and executed when referenced in a discount code comment on Shopify admin.

- Payout: $1,000
- Severity: medium
- Program: Shopify
- Credited: mosuan
- Disclosed: 2019-06-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/618031
- Library page: https://bugbountylibrary.com/r/h1%3A618031
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:regression vuln:xss

**Target:** Shopify admin discounts section (product name rendering in discount comments)
**Root cause:** A change to discount timelines stopped escaping product names, so a product name containing HTML/JS was rendered raw when referenced in a discount code comment.
**Steps:**
1. Create a product with name `'"><img src=x onerror=alert(domain.domain)>'`
2. Go to `Discounts->code` at `/admin/discounts/<id>`
3. Add a comment and select the product just created
4. Payload executes (alert) in admin context
**How found:** Noticed product names were no longer escaped after a change to discount timelines; tested by injecting an img onerror payload into a product name and referencing it in a discount comment.
**Exploitation:** Attacker with a staff account holding `discounts` permission creates a malicious product name, then references it in a discount comment; the stored payload executes for anyone viewing the discount, outside the rich text/theme editors.
**Insight:** After platform changes to rendering paths (here discount timelines), re-test escaping of previously-safe fields like product names when referenced in new contexts such as comments.