webPromedium
Lab 353 — MailForge — Insecure Deserialization via Custom Session Handler
hackadvisor
Task: PHP email campaign platform (MailForge) with custom session handler that deserializes session values prefixed with '!', inspired by CVE-2025-49113. Solution: Injected a serialized LogStreamProcessor object via the _from GET parameter on the upload endpoint, triggering RCE through the __destruct() magic method to exfiltrate the flag.
$ ls tags/ techniques/
rcephpfile_uploadnginxdeserializationobject_injectionunserializegadget_chainsession_handlercustom_serializationcve_2025_49113php_magic_methods
php_object_injection_via_session_handlercustom_session_deserialization_triggermagic_method_rce_via_destructcommand_output_redirect_to_webrootexclamation_prefix_deserialization_trigger
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 133 — MailForge — SSTI via Handlebars Template Preview— hackadvisor
- [web][Pro]Lab 124 — SprintForge — Insecure Deserialization via Cookie Session + Debug Key Leak— hackadvisor
- [web][Pro]SendForge— hackadvisor
- [web][Pro]PageForge— hackadvisor
- [web][Pro]KnowledgeForge — File Upload RCE via MIME Type Confusion— hackadvisor