SQL: SELECT * FROM cart WHERE cart_key = ? ORDER BY id
PARAMS: ["s03d8f3a68a4c98da2f221991426c422f"]
DRIVER: PDO sqlite3 / PHP 8.5.11
Cart - OWASP Shop Lab (PHP)
OWASP Shop Lab (PHP) mode: vuln switch login
Training target. This page is intentionally vulnerable. Keep this deployment private - see README.

LAB hint panel - cart

  • A04-02 Negative quantity
    qty=-99
  • A04-03 Price taken from the client
    edit price in the form
  • A03-18 Code injection via coupon
    coupon: 0.5;file_put_contents("pwned.txt","x")
  • A01-09 CSRF: no token on POST
    pocs/csrf-poc.html

Cart

Your cart is empty. Browse products.

LAB