An anonymous commenter could plant a script that ran in an administrator's browser and, from there, uploaded a web shell…