By "using simple HTML injection" I'm thinking of a form where they don't sanitize input so you could put a <video> tag in the 'name' field and suddenly the video would appear on the page.
Getting access to the administrator account is pretty different.
Not for a high school student. School networks tend to be very insecure, and the students tend to see them as just another resource in their education.
Getting access to the administrator account is pretty different.