C9 single-quoted attribute

The value sits in value='...'. Break the single quote: ' onmouseover='alert(document.domain)

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only