title: Cross Site Scripting with Hidden Inputs
body: <p>My company gave me the task of resolving all security issues with a particular application. The security tream reported a cross site scripting error. The error lies in the following input field:</p>
  
  <pre><code>&lt;input type="hidden" name="eventId" value="${param.eventId}"/&gt;
  </code></pre>
  
  <p>The report from security wasn't very detailed, but the say they can make a POST request to the page that has the above tag including the following malicious code:</p>
  
  <pre><code>eventId=%22%3e%3csCrIpT%3ealert(83676)%3c%2fsCrIpT%3e
  </code></pre>
  
  <p>And that when the page reloads, it will have the following:</p>
  
  <pre><code>&lt;input type="hidden" name="eventId" value=""&gt;&lt;sCrIpt&gt;alert(83676)&lt;/sCrIpt&gt;&lt;/value&gt;
  </code></pre>
  
  <p>I am trying to "be the hacker" and show the vulnerability. But I can't figure out how they manage to get that script in there. I am guessing they include it as a URL parameter in the GET request for the form, but when I try to do it myself I get a 403 error. Does anyone know how the vulnerability can be shown?</p>
  
  <p>I know there is a number of XSS questions on the site, but none seem to hit this topic.</p>