Is the iframe really needed? Looks like the vulnerability can be triggered without this iframe redirection.