WebApp Sec: Re: GET and POST Methods Accepted

["Amit Klein (AKsecurity)" <aksecurity () hotpop com>]

On 12 Oct 2005 at 15:04, Welsh, Ed wrote:

If the site will accept the GET method for
> form data and is vulnerable to XSS, the attack surface greatly increases over a site that is
> vulnerable to XSS but only accepts the POST method.  POST is still attackable, but it becomes more
> complicated than simply emailing a link.
An attacker can email a link to his/her own website/page, and this specially crafted page 
can contain a form (with method=POST and action being the vulnerable URL) followed by a 
piece of Javascript that submits this form. So XSS on POST method URLs isn't much more 
complicated than XSS on GET URLs.

-Amit