Done with the same exploit in another location, I managed to take over this account, with permission:  coolguy

The bad news is that I was able to do it. The good news is that I have limited access. I can't change someone's password because I'd need their password to do it in the control panel. Plus, nowadays passwords aren't stored in cookies-- only the session ID and user ID. Meaning, if someone hijacks your account, all they can really do is post as you.

The exploit was done through the comissions page, but with the contact information fields, which weren't filtered to escape HTML on the comissions page itself. Which, unfortunately, implies that escaping is only done server-side, and not on the database level. In my opinion, it should be done on the database level, but maybe that's why I'm a hacker and not a coder here. :)

This is still bad, but it's not as bad as you think it'd be. It's kind of like being covered in dog shit as opposed to elephant shit-- regardless, you're covered in shit, but the type is what matters here.