VulnMart — Vulnerable Full-Stack E-Commerce Lab

VulnMart is an intentionally vulnerable full-stack e-commerce web application designed for cybersecurity training, penetration testing practice, code review, and DevSecOps learning.

Browser / Attacker
       │
       ▼
 [ Nginx Proxy ] (Port 8080)
       ├───► / (Frontend UI - React :3000)
       ├───► /api/* (Express Backend :4000)
       ├───► /uploads/* (Static Uploads Directory)
       └───► /internal/* (Admin Gateway Route)
               │
               ▼
        [ PostgreSQL ] (Port 5432)

• Docker & Docker Compose

Clone the repository and launch the container cluster:

git clone git@github.com:sameer0xsec/vulnmart.git
cd vulnmart
docker compose up -d --build

Access the application in your browser at: 👉 http://localhost:8080

To stop and remove containers:

docker compose down -v

The database is pre-seeded with sample user accounts (passwords stored using intentional weak MD5 hashing):

VulnMart implements 25+ deliberate security flaws with comprehensive inline code annotations (// VULN:). Full exploit details and remediation guidance can be found in VULNERABILITIES.md.

• SQL Injection (Login Bypass): Authentication SQL string concatenation (auth.js).
• SQL Injection (UNION Exfiltration): Product search endpoint leaks complete user tables including credential hashes.
• Remote OS Command Injection: Shell execution (exec()) during invoice PDF generation (invoice.js).
• XML External Entity (XXE): Product bulk import parser vulnerable to file disclosure and SSRF (import.js).
• Server-Side Prototype Pollution: Insecure lodash.merge on cart restoration (import.js).

• JWT Algorithm "none" Vulnerability: Verification accepts unverified none algorithmic tokens.
• Weak Hardcoded JWT Secret: Symmetric HS256 secret (secret123) easily cracked offline.
• Weak Password Storage: Legacy unsalted MD5 hashes in database and seed scripts.
• No Rate Limiting / Brute-Force: Lack of throttling on authentication endpoints.
• Insecure Cookies: Missing HttpOnly, Secure, and SameSite flags on authentication cookies.

• Mass Assignment: Registration accepts arbitrary role parameters allowing direct self-assignment to admin.
• Vertical Privilege Escalation: User role-update endpoint missing administrative checks.
• Missing Function-Level Access Control: Unauthenticated/unauthorized product deletion endpoint.
• Insecure Direct Object Reference (IDOR): Predictable numeric IDs expose any user's order details.

• Stored Cross-Site Scripting (XSS): Unsanitized product reviews rendered with dangerouslySetInnerHTML.
• Reflected Cross-Site Scripting (XSS): Search query parameters rendered raw into the DOM.
• Open Redirect: Unvalidated redirect URL parameter on login completion.

• Arbitrary File Upload: Unrestricted avatar and product image uploads without MIME or extension validation.
• Path Traversal: Arbitrary local file disclosure through unvalidated file name query parameters (/api/files).

• Server-Side Request Forgery (SSRF): Remote product image importer allows probing internal container networks and cloud metadata services.
• Sensitive Data Exposure: User management endpoints leaking password hashes in JSON responses.
• Insecure CORS: Reflects arbitrary Origin headers combined with credentials: true.
• Nginx Configuration Flaws: Enabled server_tokens, directory listing (autoindex on), and direct unauthenticated reverse proxy routing to /internal/.

1. Initial Access: Bypass login via SQL Injection (admin' -- ) or register a new user with {"role": "admin"} via Mass Assignment.
2. Internal Reconnaissance: Utilize the SSRF import endpoint (/api/import/product-image-from-url) to scan internal microservices and database ports.
3. Data Exfiltration: Perform UNION SQL injection on /api/products/search/query or exploit XXE in /api/import/products-bulk-xml to read sensitive files (e.g., /etc/passwd).
4. Remote Code Execution: Exploit the Command Injection flaw on /api/invoice/:id/pdf to gain shell access inside the backend container.

1. Reconnaissance: Explore the application manually via the browser and map API endpoints using Burp Suite or curl.
2. Vulnerability Assessment: Follow the test cases outlined in VULNERABILITIES.md.
3. Exploitation: Build automated PoC scripts verifying each vulnerability.
4. Remediation: Apply secure coding practices (parameterized queries, input sanitization, token validation, secure headers) and verify that the exploits are mitigated.

This project is created strictly for educational, defensive, and authorized penetration testing training. The author and contributors assume no liability for misuse or damage caused by the use of this software.