day01-sessionreaper-lab

1일차 — SessionReaper 스타일 취약점 실습 랩 교육용 이것은 CVE-2025-54236"SessionReaper"에 대해 보고된 핵심 아이디어를 시뮬레이션 하는 아주 작은 랩입니다: 바로 중첩된 JSON의 부적절한 검증으로 인해 위험한 코드 경로로 이어지는 문제입니다. 이것은 Magento/Adobe Commerce가 아니며 , Docker 안에서 안전하게 실습할 수 있도록 만든 최소한의 교육용 복제본입니다. 빠른 시작 root@kitploit: chmod +x entrypoint.sh docker build -t...

CVE-2025-54236

Adobe Magento SessionReaper LFI PoC 취약한 Adobe Magento 버전에 영향을 미치는 CVE-2025-54236 SessionReaper 취약점을 시연하는 간단한 Python 개념 증명PoC입니다. 교육 및 승인된 보안 테스트 전용입니다. 기능 자동 대상 URL 정규화 무작위 formkey 생성 파일 업로드 요청 자동화 업로드 파일 확인 성공적인 업로드를 success.txt에 저장 오탐false positives을 falsepositive.txt에 저장 연결 시간 초과 및 재시도 지원 영향을 ...

Metasploit Wrap-Up 12/12/2025

React2shell Module As you may have heard, on December 3, 2025, the React team announced a critical Remote Code Execution RCE vulnerability in servers using the React Server Components RSC Flight protocol. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0 and is informally...

📄 Magento SessionReaper Remote Code Execution

This Metasploit module exploits CVE-2025-54236 SessionReaper, a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution. The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an...

The Grim SessionReaper (CVE-2025-54236) Comes to Collect for Halloween

...

Thousands of online stores at risk as SessionReaper attacks spread

Early September, a security researcher uncovered a new vulnerability in Magento, an open-source e-commerce platform used by thousands of online retailers, and its commercial counterpart Adobe Commerce. It sounds like something straight out of a horror movie: SessionReaper. Behind the cinematic na...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 aka SessionReaper, carries a CVSS score of 9.1 out of a maximum ...

PT-2025-37037

Adobe released an emergency fix for “SessionReaper,” a critical Adobe Commerce/Magento flaw CVE-2025-542360, CVSS 9.1 enabling session hijacking and potentially unauthenticated RCE. No in-the-wild exploitation reported; patches and guidance are available...

PT-2025-36491

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions prior to 2.4.10 Magento Open Source affected versions not specified Description An improper input validation issue, known as SessionReaper, exists in the REST API, specifically within the ServiceInputProcessor and the...