⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A05 – Injection

OWASP A05:2025 CWE-89 CWE-78 CWE-79

Injection is a single idea — user data is treated as code by an interpreter. The interpreter changes (SQL engine, shell, browser), the bug pattern is identical.

CWE-89 SQL Injection CWE-78 OS Command Injection CWE-79 Reflected XSS
CWE-78 OS Command Injection

A "network diagnostic" tool runs ping through a shell. The hostname goes into the command string unescaped — semicolons chain new commands.

Vulnerable code: 
subprocess.run(f"ping -c 1 {host}", shell=True, capture_output=True)

Try it yourself

Ping a host

Enter 127.0.0.1 — output looks like a normal ping.

Chain a second command

Enter 127.0.0.1; id. The shell runs both — the id output proves arbitrary commands execute.