This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)# Day 1 — SessionReaper-style Vulnerable Lab (Educational)
This is a tiny lab that **simulates** the core idea reported for CVE-2025-54236 (“SessionReaper”): _improper validation of nested JSON leading to dangerous code paths_. This is **not** Magento/Adobe Commerce; it's a minimal educational replica to practice safely in Docker.
## Quickstart
```bash
chmod +x entrypoint.sh
docker build -t day1-reaper .
docker run --rm -d -p 8080:80 --name day1 day1-reaper
# Visit http://localhost:8080/public/
```
! If you stuck you can use ./exploit.sh (after the container is running)
[4.0K] /data/pocs/baea9ba72bad6484c1228b70b615edb2e96d9dc4
├── [ 252] DISCLAIMER.md
├── [ 524] Dockerfile
├── [ 361] entrypoint.sh
├── [ 342] exploit.sh
├── [4.0K] public
│ ├── [4.0K] api
│ │ └── [1020] service.php
│ └── [ 568] index.php
└── [ 587] README.md
2 directories, 7 files