Technology @lemmy.world tkw8 @lemm.ee 3 wk. ago

I’m Lovin’ It: Exploiting McDonald’s India APIs to hijack deliveries and order food for a penny

eaton-works.com I’m Lovin’ It: Exploiting McDonald’s APIs to hijack deliveries and order food for a penny

A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people’s delivery orders, view user information, and more.

cybersecurity @infosec.pub 🃏Joker @sh.itjust.works 1 mo. ago

I’m Lovin’ It: Exploiting McDonald’s APIs to hijack deliveries and order food for a penny

eaton-works.com /2024/12/19/mcdelivery-india-hack/

8 comments

A $240 gift card seems quite low for bugs that would allow you to order (essentially) free food, access the orders and invoices of other users, driver's personal information and their real time location.
- Yeah I'd be insulted. I think a good compromise would be to demand a higher amount, but to be donated to a charity.
  
  Like Ronald McDonald House Charities
  
  That's still insignificant compensation
Fantastic read!
$240 LMAO
And what an impressive list of bugs that is...

You've viewed 8 comments.