Invoice INV-1002

Bill to : you
Items   : Rat Hoodie x1
Total   : $49.0
Card    : 4000-****-****-0002

Export a saved report

Downloading an invoice never checks who owns it. The report export joins your file to a directory with no sanitisation - ?file=../../etc/passwd.