BuggyMart - A Vulnerable E-commerce Website

⚠️ Warning: This web application is intentionally designed with severe security vulnerabilities. It is for educational purposes only. Do not deploy it on a live server or use it for anything other than security training in a controlled environment.

BuggyMart is a simple e-commerce website built with PHP and MySQL. It is designed to be an easy-to-understand platform for learning about common web application vulnerabilities.

Features & Vulnerabilities

This project now contains six distinct vulnerabilities for educational purposes:

• User System (login.php): Vulnerable to SQL Injection.
• Contact Page (contact.php): Vulnerable to Stored Cross-Site Scripting (XSS).
• User Profile (profile.php): Vulnerable to Insecure Direct Object Reference (IDOR).
• Admin Panel (admin.php): Vulnerable to Authentication Bypass.
• File Uploads (upload.php):
  1. Vulnerable to Unrestricted File Upload.
  2. Vulnerable to Path Traversal on the delete function.

Tech Stack

• Frontend: HTML, Bootstrap 5, custom CSS, JavaScript
• Backend: PHP (procedural, no frameworks)
• Database: MySQL

How to Run Locally with XAMPP

Step 1: Install XAMPP

1. Download and install XAMPP from the official website.
2. Run the XAMPP Control Panel.

Step 2: Place Project Files

1. Create a folder named buggymart inside the htdocs directory of your XAMPP installation (e.g., C:/xampp/htdocs/buggymart).
2. Place all the project files (index.php, login.php, etc.) inside this buggymart folder.
3. Inside buggymart, create the following sub-folders:
   • css (and place style.css inside it)
   • js (and place main.js inside it)
   • images (for product images)
   • uploads (this will be created automatically if it doesn't exist)

Step 3: Start Apache and MySQL

1. In the XAMPP Control Panel, click the Start button for both the Apache and MySQL modules.

Step 4: Create the Database

1. Open your web browser and navigate to http://localhost/phpmyadmin/.
2. Create a new database named buggymart_db.
3. Select the new database and go to the SQL tab.
4. Copy the contents of database.sql and execute it to create the tables and sample data.

Step 5: Access the Website You are all set! Open your browser and go to:

http://localhost/buggymart/

You should now see the enhanced BuggyMart homepage.

Sample Credentials

• User: user / password123
• Admin: admin / adminpass