nice find, however the perl command is unnecessary. <IMG SRC=http://kt-media.knowtechie.netdna-cdn.com/wp-content/uploads/2014/12/hacker1.jpg> works as we

nice find, however the perl command is unnecessary. <IMG SRC=http://kt-media.knowtechie.netdna-cdn.com/wp-content/uploads/2014/12/hacker1.jpg> works as well. the server isn't executing perl, it's just not escaping client input allowing you to add html tags to the result page. edit: i should say - it's absurd that anyone can launch a website with this kind of vulnerability in 2015. every html rendering framework i've ever used/read about automatically sanitizes user input when generating the html. the only accidental way i can imagine someone doing this is building html from string concatenations... edit2: for a simple challenge, try to embed other tags. like A or SCRIPT