POC详情： c90c53f7b15bd44dedfe35f2cb138184c162944e

来源
https://github.com/brokendreamsclub/CVE-2025-53691
关联漏洞
标题： Sitecore Experience Manager 安全漏洞 (CVE-2025-53691)
描述：Sitecore Experience Manager（XM）是丹麦Sitecore公司的一个管理软件。 Sitecore Experience Manager 9.0至9.3版本和10.0至10.4版本和Sitecore Experience Platform 9.0至9.3版本和10.0至10.4版本存在安全漏洞，该漏洞源于反序列化不受信任数据，可能导致远程代码执行。
描述
Remote code execution (RCE) through insecure deserialization
介绍
### CVE-2025-53691: Remote code execution (RCE) through insecure deserialization

The same reflection mechanism in the `AjaxScriptManager` can be used to invoke the `ProcessSerializedData` method. This method deserializes a provided payload using the insecure `BinaryFormatter`, leading to RCE. An attacker can craft a malicious serialized object to execute arbitrary commands on the server.

**Remote Code Execution:** The attacker uses CVE-2025-53691 to execute arbitrary code on the server.

## Mitigation

Sitecore has released patches for this vulnerabilitie. It is strongly recommended to upgrade to the latest version of Sitecore XP or apply the provided security patches.

## Reference

[1] Watchtowr Labs. (2025). [*Cache Me If You Can: Sitecore Experience Platform Cache Poisoning to RCE*.](https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/)
文件快照

 [4.0K]  /data/pocs/c90c53f7b15bd44dedfe35f2cb138184c162944e
├── [ 13K]  exploit.py
├── [1.0K]  LICENSE
└── [ 902]  README.md

0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。