From 8cdac0dcb6381f11c9e4058d504701fb20be312c Mon Sep 17 00:00:00 2001
From: test <test@meghsakha.com>
Date: Tue, 21 Jul 2026 10:39:18 +0200
Subject: [PATCH] init: deliberately vulnerable demo (CWE-798/327/89/78/319)

---
 README.md | 3 +++
 auth.py   | 6 ++++++
 crypto.py | 9 +++++++++
 db.py     | 9 +++++++++
 net.py    | 4 ++++
 5 files changed, 31 insertions(+)
 create mode 100644 README.md
 create mode 100644 auth.py
 create mode 100644 crypto.py
 create mode 100644 db.py
 create mode 100644 net.py

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..77d775a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,3 @@
+# cra-vuln-demo
+Deliberately vulnerable Python app for testing CRA control-tagging.
+Hardcoded creds, weak crypto, SQLi, command injection, cleartext HTTP.
diff --git a/auth.py b/auth.py
new file mode 100644
index 0000000..b980335
--- /dev/null
+++ b/auth.py
@@ -0,0 +1,6 @@
+# Deliberately vulnerable: hardcoded credentials (CWE-798)
+API_KEY = "sk_live_51HxYzABCDEFghijklmnopqrstuvwxyz0123456789"
+ADMIN_PASSWORD = "admin123"
+
+def login(user, pw):
+    return pw == ADMIN_PASSWORD
diff --git a/crypto.py b/crypto.py
new file mode 100644
index 0000000..4764006
--- /dev/null
+++ b/crypto.py
@@ -0,0 +1,9 @@
+import hashlib
+from Crypto.Cipher import DES
+
+def weak_hash(data):
+    return hashlib.md5(data.encode()).hexdigest()   # weak hash (CWE-327/328)
+
+def encrypt(data, key):
+    cipher = DES.new(key, DES.MODE_ECB)              # weak cipher (CWE-327)
+    return cipher.encrypt(data)
diff --git a/db.py b/db.py
new file mode 100644
index 0000000..a44e780
--- /dev/null
+++ b/db.py
@@ -0,0 +1,9 @@
+import os
+
+def get_user(conn, user_id):
+    cur = conn.cursor()
+    cur.execute("SELECT * FROM users WHERE id = " + user_id)   # SQL injection (CWE-89)
+    return cur.fetchall()
+
+def ping(host):
+    os.system("ping -c 1 " + host)                              # command injection (CWE-78)
diff --git a/net.py b/net.py
new file mode 100644
index 0000000..6a0fde5
--- /dev/null
+++ b/net.py
@@ -0,0 +1,4 @@
+import requests
+
+def fetch(path):
+    return requests.get("http://api.internal.example/" + path)  # cleartext transport (CWE-319)