The query is echoed into the body unencoded. Pop alert(document.domain).
alert(document.domain)
CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only