Unlimited free burgers — Hacking McDonald’s India

What if I told you it was possible to order free burgers from McDelivery India — in a single order — without spending an extra rupee?

While casually exploring the McDelivery platform, I stumbled upon a critical vulnerability that allowed promo items meant to be “one per order” to be multiplied endlessly. What started as a curiosity turned into a serious bug bounty report revealing a flaw with potential for massive abuse — and business loss.

The Background

McDonald’s offers these “promo items” as discount on their MCDelivery platform. They range from things like “Free X burger on Y order value” or “Get Fries/ Coke with your order”

The way this works is you fulfill the offer conditions and then from your cart select the offer you want post which the associated free item is added to your cart

The Problem

The platform follows a pretty simple cart system -

To view the current cart and the items the request:

GET https://be.mcdelivery.co.in/cart/?business_model_id=4&restaurant_id=<restaurant-id>

This shows all the items in the cart currently, the key “promo_item”: true tells us that this is the free item. Also giving us the “id” of the item. Make note of the free Mexican aloo tikki burger I got as part of an offer.

Now, to add 1 quantity of any item to the cart, the request would be:

PUT https://be.mcdelivery.co.in/cart/items/<id>

Here replace the <id> to be the id of the free item from the above request — and voila! You now have 2 of the free items. Repeat this request 10 more times and now you have:

Let’s also confirm with the cart API, we see quantity: 10 successfully added to the cart:

No change in final amount even on the final payment screen:

Conclusion

Here the backend failed to limit the quantity increase of items marked as “promo_item” making every promo/ free items vulnerable to a cart promo limit bypass issue — making your McDonald’s order essentially free.

Timelines:

Reported to McDelivery Bug Bounty — May 16th, 2024

Suspected fix — May 18th, 2024 (They fixed it and never responded)