DOM clobbering: the script reads window.CONFIG.url and writes it into a sink. There is no such JS global - inject named elements to forge it via the stored guestbook (/stored): <a id=CONFIG><a id=CONFIG name=url href="javascript:alert(document.domain)">, then load this page.
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only