GET and POST Interchangeable

The application was found to allow parameters using either the HTTP GET or POST methods interchangeably. This provides two separate HTTP method inputs to the application server which may have implications such as allowing certain attacks to be more effective and sensitive data being unnecessarily stored in URL access logs.
In the context of encrypted HTTP communication over TLS/SSL, POST method requests when converted to GET method ones may result in query parameters being appended behind the GET URL, which may inadvertently be stored in systems with URL access logging. Some of this information sent over in GET query parameters could potentially be sensitive.
In addition, the ability to swap between GET and POST methods could allow an attacker to carry out certain attacks more effectively, such as cross-site scripting (XSS) payloads embedded within a link or cross-site request forgery (CSRF) containing malicious actions, both of which could be delivered via simple URL link masquerading as a trusted resource. This is not possible with POST requests where parameters are sent in the HTTP request body. In certain cases, interchanging GET and POST requests may also allow an attacker to evade input validation on parameters using GET where POST is the expected method of delivery.

This RFE is requested as IBM directed to do so in case/PMR : TS001005338