Can cross-site scripting be achieved using an XMLHttpRequest as a post method? For instance, in a chatroom where users can enter text.
Normally, inserting scripts like
<script>alert("test")</script>But what if I manage to circumvent the filter by sending an XMLHttpRequest request so that the post data goes directly to the server without passing through any security checks? Would I then be able to insert and execute script tags?
If needed, I can provide visual aids to better illustrate this concept. Thank you for your responses and keep being awesome!