I found out I can inject html into my school’s online hall pass system.

If I use a <script> tag, I can run js on the computer of the teacher who approves the pass. I already reported it to the it department, but I’m just curious: what could be done with this? I won’t run anything, of course (I’d be suspect #1), but what could potentially be done?

submitted by /u/ari_02468
[link] [comments]

from hacking: security in practice https://ift.tt/I3mD1Rv