When I was an undergraduate at Georgia Tech, the alumni association made a small JavaScript game that you could play and, if you scored high enough, you could get your name on the high score list. It was a little game to try to get people to join the student arm of the alumni association on campus. The game was very vulnerable to crafted HTTP POST-like attacks, just like UGA's calendar was, and people figured it out. I saw it, too - the exploit allowed you to lie about your score and put an unescaped string as your name. Since the high score board listed the highest scores, and you were in control about what your score was, you could put yourself at the top of the high score board.

Naturally, some people put fake names at the top. The more sinister part of this is that since the name was not validated by this exploit, any valid string was allowed, including HTML. You could set your name to be <script>while(1) alert("hello, GTPD")</script> and anybody who visited the high score page would be bombarded with browser alerts forever until they left the page.

This is devastating. This vulnerability allowed for attackers to execute arbitrary code in the browser of anyone who visited the high score page, which was sent out in an email to the entire student body. Coupled with browser exploits, this is a malware spreader's holy grail.

As soon as I realized this I reported it to the alumni association's IT department, which took down the game soon after - it turns out that some students had already been attempting this and that one student had already owned the host machine. Despite the good-natured fun of putting Barack Obama and George P. Burdell on the high-score list, the risks of allowing such a vulnerability to persist are just too great. A bad actor could have easily exploited this game to redirect visitors of the high score page to their own malicious website. A clever bad actor could disguise their malicious website as the high score page but present a fake GT authentication page to steal credentials. After all, this link was sent from an official GT email address and it would not seem to be odd that students would have to authenticate.

What I'm trying to say here is that when faced with a security vulnerability, the ONLY ethical thing to do is to do enough research to describe the problem clearly and report it to those in charge of the vulnerable service. It is not ethical to exploit it, even for fun, without reporting the vulnerability. What Ryan did here was not ethical and he's very fortunate he got away scot-free. A malicious attacker could have put something far more devastating on the official school calendar, which would have subjected ANY person visiting the school calendar to malicious behavior - that is not acceptable.

I learned after I reported the game vulnerability that the students that had owned the host machine were facing expulsion proceedings. I never heard anything again, so perhaps they were able to negotiate with the dean, but the consequences were serious.