4 ms·
Nice find! There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it. > They could keep this scr
by krab 2y ago
Nice find!
There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it.
> They could keep this script running for months, even years, creating awkward scenes and uncomfortable conversations at every restaurant across the country.
If that's about the worst thing you can actively do, then it's only about the data leak.
- sschueller 2y agoAren't phone numbers being leaked if you iterate over the tables?
- krab 2y agoYeah, that's the PII leak.
- McDyver 2y ago"Why were you at X when you told me you were at Y? And why did you order for 2 people? Why have you been going there for the last Z months?" "By following the pattern of when you were there and what you ordered, I found the other person's details too"
- zekica 2y agoNo, that's the most inconvenience you can cause. There are worse things you can do: target specific people with spurious orders, cancel everything they order, or if you want add random items to every order, making the entire system useless.
- jatins 2y agopeople are underestimating the havoc this could create in a country like India. Imagine serving chicken at a table that is strictly vegetarian (many people in India are vegetarian due to religious reasons), will lead to a lot of outrage.
- sjamaan 2y agoThis could even be lethal if you are ordering something you know the target is allergic to...
- urbandw311er 2y agoIn the EU the leak of the mobile number alone would be sufficient for this to count as a serious breach