OWASP Shop Lab (PHP) mode: vuln switch login
Training target. This page is intentionally vulnerable. Keep this deployment private - see README.

LAB hint panel - ping

  • A03-20 OS command injection
    ?host=127.0.0.1;id

Network diagnostic

Real command execution is enabled and unfiltered. Anyone who can reach this page runs commands as your hosting user.
LAB