right. you still have to get from attacker-supplied data to putting that data where it can be accessed/loaded, but there are many many techniques for this just seeing the pattern should be enough to raise the hairs on the back of any sufficiently security minded person's neck
