This restaurant ordering platform contains 18+ security vulnerabilities for pen testing.
| Vulnerability | Endpoint | OWASP Category |
|---|---|---|
| SQL Injection (login bypass) | /login | A03:2021 Injection |
| SQL Injection (menu search) | /menu/search | A03:2021 Injection |
| Stored XSS | /reviews | A03:2021 Injection |
| Reflected XSS | /menu/search | A03:2021 Injection |
| IDOR (view any order) | /order/<id> | A01:2021 Broken Access |
| PCI Data Exposure | /api/customers | A02:2021 Crypto Failures |
| CSRF on Refunds | /order/<id>/refund | A01:2021 Broken Access |
| Command Injection | /tools/receipt | A03:2021 Injection |
| Path Traversal | /invoices | A01:2021 Broken Access |
| Broken Access Control | /manager | A01:2021 Broken Access |
| Unauthenticated API | /api/customers | A07:2021 Auth Failures |
| Gift Card Enumeration | /gift-cards/check | A04:2021 Insecure Design |
| Hardcoded Secrets | source code | A02:2021 Crypto Failures |
| Debug Info Leak | /debug | A05:2021 Misconfig |
| Open Redirect | /redirect?url= | A01:2021 Broken Access |
Default accounts: manager/manager123 | alice/password | bob/123456