Chaining Vulnerabilities to Exploit POST Based Reflected XSS

This report describes reflected POST-based XSS vulnerabilities and demonstrates three practical exploitation chains—method tampering (converting POST to GET), CSRF form submissions, and spoofed-JSON via CSRF—using a Flask lab and Burp Suite proof-of-concepts to illustrate how an attacker can trigger XSS despite POST-only endpoints.