I´m pentesting a clients website and found a self XSS Vulnerability in the Login Page: in case of a login error the Error Page shows the Username, so if you input
<script>alert("XSS")</script> as User, it shows the alert box.
However, it´s probably not that likely, that users do that by themselves. So I´m looking for a way to further exploit this.
My first idea was to generate a link with the parameters of the POST Request in the URL so I would get a reflected XSS if somebody clicked it. But the username and password parameters are sent in the request body and not I the URL. And according to this answer: How to exploit XSS in POST request when parameter is going in body? it is not possible to craft a link with the body Parameters in the URL.
I´m guessing the application could have more problems with Input Validation but since this is a blackbox test I have no credentials and can only work with the Login Page. So does anyone have any ideas/could point me in the right direction how I could "upgrade" the self XSS to a more severe Vulnerability?
EDIT: Thanks for the Help, I managed to get a CSRF. In Case someone is reading this in the future: Burp Suite has a cool feature for this: right click on the Request, select Engagement Tools and then CSRF PoC. It will then create a basic HTML Page that submits the specified request if someone clicks the Button