Obtaining Wildcard SSL Certificates from Comodo via Dangling Markup Injection
Wow, this attack was XSS 101.And it could have been mitigated with anti-XSS 101: rejecting all form posts containing angle-brackets.