Reflected XSS POST method at partners.uber.com

Summary

A lack of proper input validation made it possible for an attacker to execute malicious JavaScript code on partners.uber.com. This reflected XSS would execute after making a POST request with an XSS payload in the path of the request. As a result, the server would directly insert the payload into the response, allowing the XSS to trigger on the page.

Thanks, @seifelsallamy!

https://www.youtube.com/watch?v=5Gg4t3clwys