Xcar exclusive storage xss

I will not destroy my old xcar. I will report it directly after finding it. The Administrator cookie is not set. I did not check and filter user input at all. As a result, if you dare to click my name...
Bytes. The result is that, as long as you enter my personal space, you can win the bid. It is too easy for people to enter their own space under the current xcar mechanism. In addition, as long as you pay attention to me, the layer-by-layer virus-like expansion speed ..
 

 Solution:Filter invalid input.