How I exploited a stored image injection vulnerability

I exploited a stored image injection vuln recently where I could repeatedly log a user into a different account and then they could never get access to their own account!

Here's how I did it.