Textbox input isn't validated/ sanitized properly. Hint 1 Inject a script in the text box. Solution Enter any malicious JavaScript code. e.g., <script>window.location.href = "http://opendns.com";</script>