I wonder ....

It could be they were doing something stupid with the get request.

The query string could link to some resource address directly that could just be flipped to point to some code. Hmm, probably something like that.

That is more of a server side application problem, if it is that.

It is good to work out what actually caused this problem, as JavaScript keeps on getting the blame when the problem actually resides elsewhere. And JavaScript is just a convenient way to get the info out, but it is not the only one; Flash, ActiveX and Applets can all be used.

Really it is tantamount to blaming cars, because getaway cars are used in bank jobs, but of course motorbikes, buses, trams, helicopters or just plain walking could be used to getaway, and the attention should be on the bank robbery itself, and ways to prevent that.

But, without details who can really tell.