Stealing passwords from McDonald's usersPosted on 6 January 2017 by Tijme Gommers. By abusing an insecure cryptographic storage vulnerability and a reflected server cross-site-scripting vulnerability it is possible to steal and decrypt the password from a McDonald’s user. Besides that, other personal details like the user’s name, address & contact details can be stolen too. Proof of ConceptReflect
![Stealing passwords from McDonald's users](https://cdn-ak-scissors.b.st-hatena.com/image/square/d7655869d511367be7f386023a00bc2e881aae39/height=288;version=1;width=512/https%3A%2F%2Ftij.me%2Fblog%2Fstealing-passwords-from-mcdonalds-users%2Fheader.jpg%3F1.4.1)