tl;dr

• DOM Clobbering to Redirect to another page
• Increasing Content using SQL Injection giving the same column multiple times
• Connection-Pool XS-Leaks to measure the time for the page to load
• Leak the flag character by character using the above techniques

tl;dr

• XSS using DOM Clobbering
• <a id="showInfos"></a><a id="SETTINGS" name=check data-timezone="aaa" data-location="eval(window.name)"><a id="SETTINGS" name="x">
• Bypass CSRF protection to execute XSS and read flag.