It wasn't just inputs, it's not enough, weak types. Using == instead of === they could brute force guess a session, it took multiple exploits to escalate till

It wasn't just inputs, it's not enough, weak types. Using == instead of === they could brute force guess a session, it took multiple exploits to escalate till they got shell access.