Low Severity
Published: Oct 25, 2026
# vuln-test-app - Intentionally Vulnerable Spring Boot Application
This is a deliberately vulnerable Spring Boot application designed for testing automated AI vulnerability remediation pipelines and security scanning tools.
## Overview
**vuln-test-app** contains exactly 3 easily-fixable security vulnerabilities:
1. **SQL Injection** - Direct user input concatenation in database queries
2. **Cross-Site Scripting (XSS)** - Unescaped user input in HTML responses
3. **Outdated Dependency** - jackson-databind 2.9.8 with known CVEs
## Codebase Structure
```
demo/
├── pom.xml # Maven configuration with vulnerable jackson-databind:2.9.8
├── src/
│ ├── main/
│ │ ├── java/vuln_testing_1/demo/
│ │ │ ├── DemoApplication.java # Spring Boot application entry point
│ │ │ ├── User.java # JPA entity for User table
│ │ │ ├── UserController.java # REST controller with XSS vulnerability
│ │ │ └── UserRepository.java # Repository with SQL Injection vulnerability
│ │ └── resources/
│ │ └── application.properties # Database and application configuration
│ └── test/
│ └── java/vuln_testing_1/demo/
│ └── DemoApplicationTests.java
└── RALLY_VULNERABILITIES_EXPORT.csv # Vulnerability export for Rally/tracking systems
```
## Vulnerability Details
### 1. SQL Injection (Critical)
**Location:** `src/main/java/vuln_testing_1/demo/UserRepository.java`, Line 27
**Vulnerable Code:**
```java
public String findUserBySqlInjection(String userId) {
String query = "SELECT name FROM user WHERE id = " + userId; // Line 27 - VULNERABLE
List<Map<String, Object>> result = jdbcTemplate.queryForList(query);
// ...
}
```
**Endpoint:** `GET /user/profile?userId=<input>`
**Attack Examples:**
- `GET /user/profile?userId=1 OR 1=1` → Returns all users
- `GET /user/profile?userId=1; DROP TA