I'M LOVIN' IT: EXPLOITING MCDONALD'S APIS TO HIJACK DELIVERIES AND ORDER FOOD FOR A PENNY

Summary from the TLDR newsletter

Flaws in the API for the McDonald's McDelivery system in India enabled several exploits such as the ability to order any number of menu items for ₹1, the ability to retrieve the details of any order, the ability to view admin KPI reports, and more. This article covers how these flaws were discovered and how they could be exploited. It looks at the technologies that the fast food company uses and explains how to secure them against attacks. McDonald's India has a bug bounty (McDonald's USA doesn't) - the researcher was rewarded a $240 Amazon gift card.