JavaScript Damn Vuln Ecom application

This is a vulnerable NodeJS and React application that is meant to be used for educational purposes. The application is a simple e-commerce application that has a number of vulnerabilities that can be exploited. The vulnerabilities are meant to be used to teach developers how to write secure code and how to exploit vulnerabilities in code. Do not run in production.

Pre-requisites

1. Docker

Running the application

1. Copy and rename the .env.example file to .env in both folders (client and server)
2. Run docker-compose up --build

Vulnerabilities

• SQL Injection
• Cross Site Scripting (XSS)
• Server Site Request Forgery (SSRF)
• JWT Token Vulnerability
• Path Traversal
• Command Injection
• XXE Injection
• Insecure Direct Object Reference (IDOR)