This is a vulnerable web application made for the 2016 CNY Hackathon. It's written in PHP and uses MySQL.
DON'T USE THIS IN A PRODUCTION ENVIRONMENT!
The operational state can be tested using the test.php file.
Needs the PHP mysqli library.
Copy the contents of the html directory into the /var/www/html or equivalent directory.
Create the database hackathon, then populate it using the database.sql file.
Build using:
docker build -t acme-webapp .
Then run using (Maps port 1337 to port 80 on the container):
docker run -p 1337:80 --rm -it --name acme-webapp-test -v`pwd`/app:/var/www/html acme-webapp
A list of vulnerabilities is available in the vuln_list.txt.base64 file. As indicated, the list is base64 encoded so you can try to find all the vulnerabilities on your own before checking it against the list. Don't cheat :).