Whitelisting goes wrong

Last December, I did testing on one of the client's web application. Going to share one of the findings that for me quite interesting.

This application used purposely for state mapping service. A user can view the updated geoportal on their state by browsing to this application.