Patched /tmp/tmpy1f9bgf0/README.md

README.md

@@ -0,0 +1,30 @@
+# DVPWA - Damn Vulnerable Python Web Application
+
+This project is a vulnerable web application written in Python, designed for educational purposes in demonstrating common web vulnerabilities. It provides a safe environment to learn about and experiment with various security flaws.
+
+## Inputs
+
+- **User Input:** The application accepts user input in various forms, such as form fields, review text boxes, and student evaluation points. These inputs are intentionally vulnerable to different types of attacks.
+- **Configuration:** The application uses YAML files for configuration, allowing customization of database settings, Redis settings, and application parameters like host and port.
+- **Database Migrations:** SQL scripts in the `migrations` directory define database schema changes and fixtures.
+
+## Outputs
+
+- **HTML Pages:** The application renders dynamic HTML pages using the Jinja2 templating engine. These pages display application data and user interface elements.
+- **Error Messages:** In case of errors, such as database errors or invalid user input, the application displays appropriate error messages to the user.
+- **Course Reviews:** Users can submit reviews for courses, which are then displayed on the course page.
+- **Student Evaluation:** Administrators can evaluate students by assigning points to them for different courses.
+
+## Key Features and Vulnerabilities
+
+- **Session Fixation:** Vulnerable to session fixation attacks. An attacker can set a user's session ID, allowing them to take over the account once the user logs in.
+- **SQL Injection:** The student creation form is vulnerable to SQL injection. Malicious SQL code can be inserted into the student name field, potentially allowing attackers to execute arbitrary database commands.
+- **Stored XSS:** The course review functionality is vulnerable to stored cross-site scripting (XSS). Malicious JavaScript code can be inserted into the review text, which is then executed when other users view the review.
+- **Weak Password Storage:** Passwords are stored as MD5 hashes, which are considered weak and vulnerable to brute-force attacks. Rainbow tables for MD5 also exist, which can be used to quickly crack the hashes.
+- **Cross-Site Request Forgery (CSRF):** CSRF vulnerabilities are also present (details not available in the provided context).
+
+## Usage
+
+The application can be run using Docker Compose or natively. The Docker Compose setup is recommended for ease of deployment and dependency management. The README provides detailed instructions for both Docker and native setups, including installation of dependencies and database initialization.
+
+The application is designed to be intentionally vulnerable, allowing users to practice exploiting these vulnerabilities and learning about the corresponding mitigations.