A common social engineering ploy which uses such reflective xss attacks is to trick users into entering obfuscated javascript code into the input box themselves. Usually under the pretense that it would be some secret trick to do something interesting on that website. But what it actually does is steal the user's login cookie and write a message with the "secret code" to everyone on their friends list.

Another use of such a reflective XSS vulnerability is to combine it with a cross-site request forgery attack. An attacker would build a form on a website they control and have it submit to the same URL on the target website which the vulnerable form submits to. They would then lure their victim to their website. The victim doesn't need to perform an action on the attacker's website, because it's possible to submit the form automatically on pageload using javascript. This only works under the conditions that 1. the vulnerable form is processed server-sided and 2. the vulnerable website doesn't validate the user's Referer header.

Should you report it as a bug even if you don't manage to find an exploit? Definitely. It's certainly not intended behavior and a sign of bad code.

A common social engineering ploy which uses such reflective xss attacks is to trick users into entering obfuscated javascript code into the input box themselves. Usually under the pretense that it would be some secret trick to do something interesting on that website. But what it actually does is steal the user's login cookie and write a message to everyone on their friends list telling them to also try out the "secret code".

Another use of such a reflective XSS vulnerability is to combine it with a cross-site request forgery attack. An attacker would build a form on a website they control and have it submit to the same URL on the target website which the vulnerable form submits to. They would then lure their victim to their website. The victim doesn't need to perform an action on the attacker's website, because it's possible to submit the form automatically on pageload using javascript. This only works under the conditions that 1. the vulnerable form is processed server-sided and 2. the vulnerable website doesn't use the standard methods to prevent CSRF attacks (validate the user's Referer header for POST requests, use a sane CORS configuration for XmlHttpRequest's).

Should you report it as a bug even if you don't manage to find an exploit? Definitely. It's certainly not intended behavior and a sign of bad code.

A common social engineering ploy which uses such reflective xss attacks is to trick users into entering obfuscated javascript code into the input box themselves. Usually under the pretense that it would be some secret trick to do something interesting on that website. But what it actually does is steal the user's login cookie and write a message with the "secret code" to everyone on their friends list.

Another use of such a reflective XSS vulnerability is to combine it with a cross-site request forgery attack. An attacker would build a form on a website they control and have it submit to the same URL on the target website which the vulnerable form submits to. They would then lure their victim to their website. The victim doesn't need to perform an action on the attacker's website, because it's possible to submit the form automatically on pageload using javascript. This only works under the conditions that 1. the vulnerable form is processed server-sided and 2. the vulnerable website doesn't use CSRF protection.

Should you report it as a bug even if you don't manage to find an exploit? Definitely. It's certainly not intended behavior and a sign of bad code.

A common social engineering ploy which uses such reflective xss attacks is to trick users into entering obfuscated javascript code into the input box themselves. Usually under the pretense that it would be some secret trick to do something interesting on that website. But what it actually does is steal the user's login cookie and write a message with the "secret code" to everyone on their friends list.

Another use of such a reflective XSS vulnerability is to combine it with a cross-site request forgery attack. An attacker would build a form on a website they control and have it submit to the same URL on the target website which the vulnerable form submits to. They would then lure their victim to their website. The victim doesn't need to perform an action on the attacker's website, because it's possible to submit the form automatically on pageload using javascript. This only works under the conditions that 1. the vulnerable form is processed server-sided and 2. the vulnerable website doesn't validate the user's Referer header.

Should you report it as a bug even if you don't manage to find an exploit? Definitely. It's certainly not intended behavior and a sign of bad code.