TypoScript XSS

 
# --- SEARCHBOX OBJECT ----------------------------------
lib.search = COA_INT
lib.search {
 stdWrap.prefixComment = 2 | lib.search
 10 = TEXT
 10.typolink.parameter = {$plugin.tx_indexedsearch.searchUID}
 10.typolink.returnLast = url
 10.wrap = <div id="searchbox"><form action="|" method="post" id="indexedsearch">
 20 = COA
 20 {
   wrap = <p> | </p>
   10 = TEXT
   10.data = GPvar : tx_indexedsearch |sword
   10.htmlspecialchars=1
   10.wrap = <input name="tx_indexedsearch[sword]" value="|" class="searchbox-sword" type="text" />
   20 = COA
   20 {
     wrap = <span> |</span>
     10 = TEXT
     10.value = <input type="hidden" name="tx_indexedsearch[sections]" value="0" />