Oh, the stupidity

[MattR]

At least you tried to explain it. To be honest custom MyCodes aren't really something I ask about when people say they've been hacked but I guess I should, it's never really crossed my mind. With this you could write something to read a cookie (mybbuser to get loginkey, adminsid to get admin session), redirect to a file on your server that stores that, and then redirect back to the original thread so nobody'd realise. Or execute a MyBB action as the post key is stored in a javascript variable. Or redirect to porn, or some other dodgy site. Or kill your CPU. Even worse that it uses onmouseover, you don't even need to click the link.