[bytetobreach33]

https://www.pakistantoday.com.pk/wp-cont...4/PLRA.jpg

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
 
 
1_OMISSION IS KEY.png
https://dumpli.st/image/7c0d83ca8321cc16.png (https://icedrive.net/s/gT7Y28ZBBh62hg8QAD6Tkyg8N2TA) https://drive.google.com/file/d/1KDUUvmV...drive_link
2_TO_DUMP_OR_NOT_TO_DUMP.png
https://dumpli.st/image/3a5b524500475901.png (https://icedrive.net/s/VbD1hktv67yGg38FZDWQhv9YA64h) https://drive.google.com/file/d/10X3iTJe...drive_link
3_CONFIRMATION.png
https://dumpli.st/image/018c3c0f49c02346.png (https://icedrive.net/s/NW8bSkN8XF82gh6vfhD232BCAP8D) https://drive.google.com/file/d/13ul3KH5...drive_link
 
** Intro :
 
A random unauthenticated PII exposure from IDOR / Broken Access Control in the PULSE systems (Punjab Urban Land Systems Enhancement) could be acessed without going through the normal website flow. The API endpoints `/api/elasticsearch/registries/search` (POST) and `/api/elasticsearch/registry/{id}` (GET) require no zero authentication and expose the entire Pakistani national land registry database, around **15,646,002 records** containing citizens' full names, spouse names, **full 13-digit CNIC (National ID) numbers**, property descriptions, property values (in PKR), tehsil/mauza locations, and transaction dates. Here's an example of a typicl property registry record from Pulse system with a translation and explanation:
 
 
| Field | Value | Meaning |
|---|---|---|
| `Id` | 10034131873 | Internal database record ID |
| `UserId` | 0 | No user assigned |
| `VendorId` | 0 | No vendor assigned |
| `UserWorkQueMasterId` | null | Not in any work queue |
| `RegisteredNumber` | `01220260003235` | Official registry registration number (deed number) |
| `JildNumber` | `0` | Volume (جلد) number of the register book |
| `PropertyNumber` | `Nill - Nill Nill Nill` | Property number (not assigned / nil) |
| `IsApproved` | false | Registry has NOT been approved yet |
| `IsJildCompleted` | false | The volume/jild is not completed |
| `BahiNumber` | `1` | بہی number — the ledger/register book number |
| `RegistryDate` | `2026-10-14` | Date the registry was executed |
| `IsActive` | true | Record is active |
| `CreatedDate` | `2026-10-14` | Date record was created |
| `ModifiedDate` | `2026-10-14` | Date record was last modified |
| `CreatedBy` | 548 | Internal user ID who created the record |
| `ModifiedBy` | 0 | No modifier yet |
| `TehsilId` | 149 | Internal ID for the Tehsil (sub-district) |
| `MauzaId` | 78247 | Internal ID for the Mauza (village/locality) |
| `Address` | (empty) | No address entered |
| `IsExported` | false | Not yet exported |
| `Area` | `16-9-263` | Land area in Pakistani units: **16 Kanals, 9 Marlas, 263** (likely Sarsahi) |
| `RegistryValue` | 1,340,000.0 | Declared value of the property: **PKR 13,40,000** |
| `RegistryExportImg` | `0` | No export image |
| `NonNullFCount` / `NullFCount` | 0 / 0 | Internal field completion counters |
| `RegistryTypeId` | 101 | Internal ID for registry type |
| `MauzaName` | **دندی** (Dandi) | Name of the Mauza/village where property is located |
| `RegistryType` | **بیع** (Bay') | Type of registry = **Sale deed** (بیع = Arabic/Urdu for "sale") |
| `Tehsil` | **پنڈی گھیب** (Pindi Gheb) | Tehsil name = Pindi Gheb (in Attock District, Punjab, Pakista
 
 
I routinely sent a brief email to jointly notify the PULSE IT and PKCERT team of the vulnerability before I publish my post, but I didn't get any answer.
As usual, no ransom is asked from anyone affiliated with the Pakistani Government.
 
 
** RECON :
 
BACKUP 1 : https://drive.google.com/drive/folders/1...drive_link
BACKUP 2 : https://icedrive.net/s/4ZNtbRZbgxz38FiZyiC72j3Ai31h
BACKUP 3 : https://e.pcloud.link/publink/show?code=...pXQSBDj6B7
BACKUP 5 : https://ln5.sync.com/dl/96e766bc0#2kr4q8...n-agq5qc9a
BACKUP 4 : https://www.mediafire.com/folder/n7c30td5oe0dj/PAKISTAN
 
 
** CONTACTS
 
Session: (05c2db4775cb46350f16814dfe3bfa856664f315585653e4c368af08ce50b0c31b)
Tox: 947E4A3A16ECF3A15E2F7183BC4CA6B2CD28F1E96F25A2694F4CA145FCBD457266414CD68287
Signal: bytetobreach.83 (https://signal.me/#eu/ckziMa6RvqTr9dQT5Z...Cq_1pnVWUn)
Telegram: Bytetobreach33 (https://t.me/Bytetobreach33)
Email : [email protected] / [email protected] / [email protected]
X: (@GgsFafagas)
 
*******************
* JESSUS IS KING *
*******************
 
-----BEGIN PGP SIGNATURE-----
 
iHUEARMIAB0WIQQVdfREVQxWr+O57L77TkNjkvgO8wUCatdYQgAKCRD7TkNjkvgO
8wTgAQDBz5ud8Z6o43y5uzXeFsEDfYPIpRsSHZ9znjOb7QIOhwD6A4L8bmzlQat2
IrzRdgSAnD3MbC/tkl1BcqRrJLkOYR8=
=9Q4Y
-----END PGP SIGNATURE-----