Yeah, you're right but I was more talking about the fact once you got access to the database, you can even upload some stuff in the website (yeah, that's an old hacking method).
For what you're talking about, yeah you're totally right. I didn't looked at this option!
But then again, you'll need to hack the database first which is enough hard to do on well protected website (like I already stated, I'm almost sure this website have a good/strong protection against this hacking attempt)
Edit: the java machine can be disable, or even restricted on most browser
TM M3 Shorty
KJW Beretta M9