A vulnerability attack on a message book (original) If you think you can, consider adding the essence for later viewing

Colleague of a website was stolen (in the Trojan), the original want to put the site password again to steal to estimate oneself not this level did not go to try (is in Etang application).
I saw he applied for a message book and thought if I could get the message book back. Scare him, give vent to vent. Looking for the change information (to steal the password here should be the entrance) start, so I also applied for the same message thin into the Change column, view the source file is as follows:
------------------------------------
<form action= "modifyok.asp" method= "POST" >
<tr class= "table001" >
&LT;TD width= "20%" align= "right" ><table class= "JNFONT5" > Username:</table></td>
&LT;TD width= "80%" > Mysoso
<input type= "hidden" name= "user" value= "Mysoso" ></td>
</tr>
<tr class= "table001" >
&LT;TD width= "20%" align= "right" ><table class= "jnfont5" > Password:</table></td>
&LT;TD width= "80%" >
<input type= "text" name= "pass" size= "" Maxlength= "class=" "Input1" value= "Mysoso" >