A Dutch security enthusiast Tijme Gommers
discovered a vulnerability known as cross-site scripting (XSS) in the
search functionality of the McDonalds website, this vulnerability allows
an attacker to load an external JavaScript file that can be
designed to steal a user's password.
Once the user clicks on the mcdonalds.com link
malicioso, their password is decrypted and sent to the attacker. Gommers said that
the vulnerabilities also expose names, addresses and other details.
Even though the researcher reported this
vulnerability to McDonalds he received no response nor saw that the
necessary measures were taken to patch it. Multiple XSS vulnerabilities
fueron descubiertos en los sitios web de McDonald en el último año, según Abra
Bounty Bug. Mientras que dos de estas vulnerabilidades fueron resueltas después
de que sus datos se hicieron públicos, otras permanecen aún sin solucionar.