The researcher began by analyzing HTTP communication during the “Pay” button click, leading to the payment gateway. It turned out all fields sent to the payment gateway (e.g., order value) were digitally signed. In short, any modification to these fields resulted in failure.
The researcher then backtracked to an earlier step—the one where the cart contents were updated (e.g., “instead of one burger, make it two”). Here’s where a “problem” appeared: the HTTP request for updating the cart didn’t include the cart’s total value. So, there wasn’t anything obvious to manipulate.
The researcher artificially added a new field to the PUT request that updated the cart:
<pre><code class="language-json">{&quot;gross-price&quot;: 1.0}
</code></pre>
The system accepted the update. In the end, all fields in the cart (including the manipulated ones) were correctly signed and passed to the payment gateway.
For the curious: the vulnerability is technically called Mass Assignment.
<img src="https://media.daily.dev/image/upload/s--y6k0Ujdy--/f_auto/v1735800158/ugc/content_26816c41-bdea-4d5b-a91b-f9371233b883" alt="mcdonald">
A link to the original post: <a href="https://eaton-works.com/2024/12/19/mcdelivery-india-hack/" target="_blank" rel="noopener nofollow">https://eaton-works.com/2024/12/19/mcdelivery-india-hack/</a>
The vulnerability was responsibly reported to McDonald’s India and subsequently patched. The researcher received a $240 Amazon gift card as a reward.

I post all the articles I read and find interesting myself.

Mobile Experts 👉🏻 https://codigee.com

Codigee

A researcher found a vulnerability in McDonald's India online ordering system that allowed menu items to be ordered for just $0.01. By manipulating the HTTP request during the cart update step, the researcher added a new field with a gross price value, which was accepted by the system. This exploit, known as a mass assignment vulnerability, was reported and patched. The researcher was rewarded with a $240 Amazon gift card.

How you could order anything in McDonald for $0.01 (India)

Only $240 gift card? The guy literally reported a big that could have cost the company thousands of dollars in order fraud, and not to mention brand damage on top of that. I mean $5000 would seem like a minimum seeing that McDs is a global brand.