This paper discusses a simple technique for injecting code by manipulating hidden form fields.
You can download it from the following link: https://packetstormsecurity.com/files/download/46482/injectpaper.txt
Source: https://packetstormsecurity.com/files/46482/injectpaper.txt.html