After re-reading the description I have to say that you're technically right. The exploit itself seems to come from the output of unsanitized data that originat

After re-reading the description I have to say that you're technically right. The exploit itself seems to come from the output of unsanitized data that originated from an "uploaded" page's code.