I Built a Deliberately Vulnerable PHP/MySQL Lab for Web Security Practice

说明与用途

构建了一个 Docker 化的 PHP/MySQL 漏洞实验室，包含 10 个有意漏洞，供安全研究人员进行真实场景的 Web 漏洞练习。

问题

Security researchers need a realistic, local environment to practice identifying and exploiting web vulnerabilities that mirror real-world applications.

结果

Users gain hands‑on experience with realistic web vulnerabilities, learn exploit chains, and understand security impacts in a safe, local setting.

工作流

• 1. Clone the GitHub repository (https://github.com/GMMB1/CMS).
• 2. Build and run the Docker containers as per the README instructions.
• 3. Explore the application to identify the 10 intentional vulnerabilities (e.g., BOLA, JWT forgery, unrestricted file upload, time-based SQL injection).
• 4. Optionally review the field manuals to understand exploit chains.
• 5. Test your own exploit techniques in the isolated environment.
• 6. Report findings or share results with the author.

证据

The application is fully Dockerized and currently contains 10 intentional vulnerabilities, including API-level BOLA, JWT forgery, unrestricted file upload leading to remote code execution, time-based SQL injection, and several other vulnerabilities left for you to discover.

来源

I also included field manuals in the repository. They walk through the intended exploit chains, so you can use them if you get stuck or want to compare your approach with mine.

来源