HAHAHAHAHAHAHA

IMG tags in BBCode don't properly sanitize

Code:

"

So, you can basically abuse that to insert additional attributes into the IMG tag that it generates. I created a blank animation and set the onanimationstart attribute to run the alert function.

fucking code box

don't forget this part either, since it relies on onanimationstart to execute the javascript

I hate it when the admin of this site didn't enable javascript 

I wanted to hax the admin acc 

i'm not really quite sure if you can hack the admin account eith javascript alone