If i understand your questions and given scenario correctly it sounds like you are refering to "Cross Site Sripting", and yes its possible.

http://en.wikipedia.org/wiki/Cross-site_scripting