VulnerableApp-php is a Vulnerable Application containing vulnerabilities specific to PHP technology stack. It is part of the farm of Vulnerable Applications provided by SasanLabs. This Vulnerable Application utilises the facilities provided by Owasp VulnerableApp-Facade and it is just exposing bunch of Api's which are vulnerable to various attacks. User Interface for VulnerableApp-php is provided by Owasp VulnerableApp-Facade.
As VulnerableApp-php doesn't provide user interface and relies on Owasp VulnerableApp-facade hence you need to start it using instructions: VulnerableApp-Facade simple start
For building the docker image and then using VulnerableApp-Facade to test the working of the application.
1. Build the docker image with command: docker buildx build --platform linux/amd64,linux/arm64,linux/ppc64le -t sasanlabs/owasp-vulnerableapp-php:latest . --push
2. Navigate to VulnerableApp-Facade and run it as described in VulnerableApp-Facade#simple-start
The NoSQL Injection vulnerability uses MongoDB. Start the PHP application and its MongoDB dependency locally with:
docker compose up --build
The PHP application is exposed at http://localhost:8080/VulnerableApp-php/. MongoDB is initialized automatically with level-specific users the first time the NoSQL Injection endpoints are used. Stop and remove local data with:
docker compose down --volumes
Please raise a github issue for enhancement/issues in VulnerableApp-php or send email to karan.sasan@owasp.org regarding queries we will try to resolve issues asap.