SQL: SELECT id, username, password, role, email, phone, card_no, card_cvv FROM users ORDER BY id
DRIVER: PDO sqlite3 / PHP 8.5.11
SQL: SELECT id, name, price, stock FROM products ORDER BY id
DRIVER: PDO sqlite3 / PHP 8.5.11
Admin - OWASP Shop Lab (PHP)
OWASP Shop Lab (PHP) mode: vuln switch login
Training target. This page is intentionally vulnerable. Keep this deployment private - see README.

LAB hint panel - admin

  • A01-01 Role carried in a client-controlled cookie
    set cookie lab_role=admin
  • A03-11 SQL console
    SELECT * FROM users
  • A01-13 Clickjacking (no X-Frame-Options)
    pocs/clickjacking-poc.html

Admin

Authorisation came from the lab_role cookie. A real fix is a server-side session role check.

SQL console

Users

IDUsernamePasswordRoleEmailPhoneCardCVV
1 admin admin123 admin admin@lab.local 13800000001 4111111111111111 123
2 alice alice123 user alice@lab.local 13800000002 4222222222222220 456
3 bob 123456 user bob@lab.local 13800000003 4333333333333330 789
4 carol password user carol@lab.local 13800000004 4444444444444440 321

Products

IDNamePriceStockSet price
1 Mechanical Keyboard $89.90 30
2 Wireless Mouse $39.50 120
3 27" 4K Monitor $329.00 14
4 USB-C Dock $119.00 45
5 Noise Cancelling Headset $199.00 22
6 Desk Lamp $45.00 60
7 Laptop Stand $32.00 75
8 Webcam 1080p $59.00 33
LAB