From 73881dc6ca7abec9fec313899eaa913d00bde157 Mon Sep 17 00:00:00 2001
From: Manuel Thalmann <m@nuth.ch>
Date: Fri, 10 Nov 2023 13:23:38 +0100
Subject: [PATCH] Add explanation about forged image

---
 Lab03 - Let's Buy Some Juice/README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Lab03 - Let's Buy Some Juice/README.md b/Lab03 - Let's Buy Some Juice/README.md
index 8ff02dd..9ac1563 100644
--- a/Lab03 - Let's Buy Some Juice/README.md	
+++ b/Lab03 - Let's Buy Some Juice/README.md	
@@ -26,3 +26,8 @@ Result:
  2. Type `<iframe src="javascript:alert('hello')">`
 
 <!--- ToDo: Insert Picture -->
+
+## Forged Picture
+This challenge is impossible due to the `/profile` page only reading the username from POST variables.
+
+POST variables cannot be set through links and thus can't be set in an `img`-tag's `src` either.