So there's this one site used by a lot of schools to make online systems that im not going to name

This year, i entered an IT-focused high school and this school also uses this site and i found out it has a comment section for schoolwork

  
So, for some reason, it allows <img> elements, it clears out all other elements like <script> (that would be horrible lol 💀), <style> and <button>..... but for some reason not <img>, and it even seems like it supports it? (it also allows text and all text formatting) Why would this site explicitly allow and caress <img> elements when it doesn't allow other elements, without having a user friendly interface to do so? You literally have to HTML inject to do this (comment something like <img src="protocol://sub.name.tld/image.png"> )

Also im thinking about all the malicious ways to exploit this, obviously i can put up any image or gif with parameters of my choice, but not gonna add gore or porn because im not an awful person and that would get me expelled immediately. One thing i thought of is that when you add an <img> element, it forces your browser to load that image, i could make the src attribute point to an endpoint i control, where it could load whatever image i want, but also basically log access to the comment section including the user's ip address (idk what i would do with that) and maybe send it to a discord webhook which could be cool

Any ideas/remarks? FYI i dont want to get expelled, we'll be having a subject tomorrow where we basically look at this subject on the site daily, so i could bait people into looking into the comment section with an image that reads "first to blink likes men/femboys" etc

HTML injection on school site