"Hacme Bank™ is designed to teach application developers, programmers, architects and security professionals how to create secure software. Hacme Bank simulates a "real-world" online banking application, which was built with a number of known and common vulnerabilities such as SQL injection and cross-site scripting. This allows users to attempt real exploits against a web application and thus learn the specifics of the issue and how best to fix it. Foundstone uses this application extensively in our Ultimate Web Hacking and Building Secure Software training classes. "
The application is written in ASP.NET (C#) and they have a "User and Solutions Guide" that walks you through the lessons. Very cool! You can find the link to download the software and the guide on Foundstone's Strategic Secure Software Page.