SQL: SELECT * FROM orders WHERE id = 1001
DRIVER: PDO sqlite3 / PHP 8.5.11
SQL: SELECT name, price, qty FROM order_items WHERE order_id = ?
PARAMS: [1001]
DRIVER: PDO sqlite3 / PHP 8.5.11
Order 1001 - OWASP Shop Lab (PHP)
OWASP Shop Lab (PHP) mode: vuln switch login
Training target. This page is intentionally vulnerable. Keep this deployment private - see README.

LAB hint panel - orders

  • A01-04 IDOR on order id
    ?id=1001
  • A01-05 Any user order list
    ?uid=3
  • A02-04 PII in plaintext
    ?id=1001

Order 1001

Order1001
User2
Total$168.90
Statuspaid
RecipientAlice
Phone13800000002
Address2 Lab Road, Test City
Card 4222222222222220
Placed2026-09-28 03:13:42

Items

ItemPriceQty
Mechanical Keyboard $89.90 1
Wireless Mouse $39.50 2
LAB