No comments yet.
Objective Store a comment that executes in other users' browsers — including the admin moderator's (stored XSS).
Post a comment containing <script>…</script> or <img src=x onerror=…>. Then view /admin/comments as the moderator would.