Description

EXIF stands for Exchangeable Image File Format and the EXIF data contains information such as the camera model and make, shutter speed, aperture, focal length, ISO number, date, time and much more. It can also store GPS coordinates of the location where an image was shot.

Proof of Concept

1.Upload any image in profile picture or comment 
2. Open picture and intercept request using burp suit.

3. Download exif metadata extension.

4. Check in repeater response Geolocation and many meta data showing.

Impact

This data breach is critical due to the following reasons:

An attacker can get the exact location where a particular photo was taken

A photo can be easily replicated by using the metadata of the image

The following image/picture shows an example of the data stored in the image metadata.