Lab 353 — MailForge — Insecure Deserialization via Custom Session Handler

hackadvisor

Task: PHP email campaign platform (MailForge) with custom session handler that deserializes session values prefixed with '!', inspired by CVE-2025-49113. Solution: Injected a serialized LogStreamProcessor object via the _from GET parameter on the upload endpoint, triggering RCE through the __destruct() magic method to exfiltrate the flag.