# API flaws in McDelivery India enabled discounted orders, order hijacking, and access to user information

DevFeed: [API flaws in McDelivery India enabled discounted orders, order hijacking, and access to user information](<https://devfeed.tech/articles/i-m-lovin-it-exploiting-mcdonald-s-apis-to-hijack-deliveries-and-order-food-for-a-penny-32612.md>)

Original publisher: [Read original article](<https://eaton-works.com/2024/12/19/mcdelivery-india-hack/>)

Author: Eaton

Published: 2024-12-19T13:00:22Z

Content type: article

Language: en

Sources: [Eaton Works Feed](<https://devfeed.tech/sources/eaton-works-feed.md>)

Topics: [API](<https://devfeed.tech/topics/api.md>), [Security](<https://devfeed.tech/topics/security.md>), [Web app](<https://devfeed.tech/topics/webapp.md>), [Website](<https://devfeed.tech/topics/website.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [bug](<https://devfeed.tech/tags/bug.md>), [security](<https://devfeed.tech/tags/security.md>), [service](<https://devfeed.tech/tags/service.md>), [user](<https://devfeed.tech/tags/user.md>), [web-app](<https://devfeed.tech/tags/web-app.md>)

## AI overview

A security disclosure describes API flaws in McDelivery India that enabled orders for INR 1, hijacking or redirecting other customers' deliveries, access to order details and invoices, order tracking, and exposure of sensitive driver information.

## Source excerpt

A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people's delivery orders, view user information, and more.