The BodgeIt Store - another vulnerable web app

Hi folks,

I've recently open sourced a vulnerable web app, called The BodgeIt Store:
http://code.google.com/p/bodgeit/

Why?

Well, you can never have too many vulnerable apps to test against, but
also because I've found that many of the existing apps are non trivial
to install - they either have a significant number of dependencies,
are restricted to specific platforms, require dbs to be set up etc
etc.

At the moment all of the vulnerabilities are pretty basic, so its not
suitable for security ninjas ;)
However you may find it useful if you give introductory training
courses, which is what I use it for.

The BodgeIt Store is:

• Easy to install - just requires java and a servlet engine, e.g. Tomcat
• Self contained (no additional dependencies other than to 2 in the
  above line)
• Easy to change on the fly - all the functionality is implemented
  in JSPs, so no IDE required
• Cross platform
• Open source
• No separate db to install and configure - it uses an 'in memory'
  db that is automatically (re)initialized on start up

There is also a 'scoring' page where you can see various hacking
challenges and whether you have completed them or not.

In the relatively near future I'm hoping to add things like:

• Ajax requests
• More vulnerabilities (of course)

Any feedback (or offers of help to develop it further;) would be appreciated.

Many thanks,

Psiinon