A cross-site scripting attack on ThinkSNS

ThinkSNS an application of cross-site scripting attacks, harm to a variety of voluntary hook user ThinkSNS published logs can carry out cross-site scripting attacks, willing to see will recruit http://t.thinksns.com for Testing 1. we need to insert a network image at will. 2. packet capture, modify as follows 3. the document and cookie are filtered out, but the location test is successful. we can construct the following link (Friendly reminder: This is only one of the most direct ways, do not filter this and no matter what else). 5. check the page source code and effect. Yes, it is inserted and redirected.
6. What can I do? See how you wrote the script ~~~ The so-called "willingness to hook" means that anyone who wants to read this log will be hooked !!
...Solution:

You know me better !!