CVE-2025-54236 PoC — Adobe Commerce | Improper Input Validation (CWE-20)

Description

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)

Readme

# Day 1 — SessionReaper-style Vulnerable Lab (Educational)

This is a tiny lab that **simulates** the core idea reported for CVE-2025-54236 (“SessionReaper”): _improper validation of nested JSON leading to dangerous code paths_. This is **not** Magento/Adobe Commerce; it's a minimal educational replica to practice safely in Docker.

## Quickstart

```bash
chmod +x entrypoint.sh
docker build -t day1-reaper .
docker run --rm -d -p 8080:80 --name day1 day1-reaper
# Visit http://localhost:8080/public/
```

! If you stuck you can use ./exploit.sh (after the container is running)

File Snapshot

Remarks