If this were true it would suggest that the invoice ID directory parameter was fetching some sort of file in order to display the PDF and the user was able to supply ".%2f" and potentially "..%2f" to specify what directory to pull from. The attacker receives the following response... { "success" : "Cart successfully updated" , "result" : { "type" : "change" , "subscriptions" : [ { "subscriptionNumber" : "[subscriptionNumber]" , "addProductInvoice" : "" , "removeProductInvoice" : "" , "meta" : { "paymentToken" : "[payment token -- this is a 32 character alphanumeric hard to guess ID]" , "oacs" : "[oacs]" , "pvtreg" : "[domain]" , "domain_name" : "[domain]" , "bizmail" : "[domain]" , "hosting" : "[domain]" , "domain" : "[domain]" } , "addRatePlans" : [ ] , "removeRatePlans" : [ ] } ] ,…