How did Samy Kamkar hack MySpace?

Samy Kamkar exploited a vulnerability in MySpace's code to inject JavaScript, which allowed him to modify his MySpace profile and perform actions without users' consent. This was known as the "Samy worm." Initially aimed to bypass photo upload limits and tweak his relationship status for humor, it evolved into a hacking tool to control the browser actions of anyone visiting his profile.

While testing these capabilities, Kamkar inadvertently created a worm that spread among MySpace profiles. The worm would make users automatically add him as a friend and declare "Samy is my hero" on their profiles. It spread exponentially until Kamkar alerted MySpace, but not before causing a major disruption and leading to a law enforcement intervention 1 2 3.