> Five minutes later, I check and it had found a /cancel.php URL that accepted an ID but the ID wasn't exposed anywhere,
so it found and was exploiting a blind SQL injection vulnerability to find my reservation ID.
xkcd was prescient once again... https://xkcd.com/416/