CSRF to XSS: Exploiting POST-Based Vulnerabilities

By /

Listen to this Post

I discovered an XSS vulnerability in a web application through a POST request. Since the form was vulnerable to CSRF, and POST-based XSS is not very powerful on its own, I escalated it into a CSRF attack that triggered XSS.

Payload Used:

&userGroupName=bugcrowd'"()%26%25<test><​ScRiPt%20>alert(12345)<​/ScRiPt>

This payload:

  • Breaks out of attributes/JS contexts using `'”()`
  • Bypasses weak filtering with encoded characters (%26 for &, `%25` for %)
  • Inserts a `` tag to evade basic sanitization
  • Executes XSS via `