I think it’s time to give some hints about the initial foothold.
As I could understand by talking to some of you on social channels, the “obvious” vulnerability everybody is talking about is correct, however you are all missing some important information to correctly exploit it.
Try to use a different wordlist to find something useful in the web app. Maybe some developer left traces of a changelog!