Unable to load image

McDonalds India Gives Researcher A $240 Giftcard (lol) For Discovering These Huge Exploits

https://eaton-works.com/2024/12/19/mcdelivery-india-hack/

The researcher figured out the following (pasted from the blogpost):

The ability to order any number of menu items for ₹1 ($0.01 USD).

The ability to steal/hijack/redirect other people's delivery orders through a specific sequence of carefully timed API calls.

The ability to retrieve the details of any order.

The ability to track any order in the "On the way" status. You could real-time track the location of the driver for any order.

The ability to download invoices for any order.

The ability to submit feedback for orders that are not your own.

The ability to view admin KPI reports.

Sensitive driver/rider information that could be accessed:

  • Name

  • Email address

  • Phone number

  • Vehicle license plate number

  • Profile picture


Saar please take this amazon giftcard I stole from your mother saar

The post is very boring as the techniques used were very basic. I'm not calling the researcher garbage, I'm saying that their website was very poorly setup.

https://i.rdrama.net/images/1737838916DHFTAGqt2a1C1w.webp


53
Jump in the discussion.

No email address required.

They did him dirty, lmao. Should have just kept it to himself and got basically free food until they patched it.


https://i.rdrama.net/images/17187151446911044.webp https://i.rdrama.net/images/1735584487Pd3ql1pai5_mfA.webp https://i.rdrama.net/images/17177781034384797.webp

Jump in the discussion.

No email address required.

he doesnt live in India tho, he lives in the US

Jump in the discussion.

No email address required.

Just have some Grubhub chump deliver it for $2.37 commission.

Jump in the discussion.

No email address required.

RIP even more. Have a nice 9 dollar big mac, stalker child


https://i.rdrama.net/images/17187151446911044.webp https://i.rdrama.net/images/1735584487Pd3ql1pai5_mfA.webp https://i.rdrama.net/images/17177781034384797.webp

Jump in the discussion.

No email address required.



Link copied to clipboard
Action successful!
Error, please refresh the page and try again.