HOW WE BUILT AN EXPLOIT FOR SESSIONREAPER, CVE-2025-54236 IN MAGENTO 2 & ADOBE COMMERCE

Summary from the TLDR InfoSec newsletter

Pentest-Tools researchers developed a working exploit for CVE-2025-54236 "SessionReaper," an unauthenticated vulnerability in Magento 2's ServiceInputProcessor that allows customer account takeover through session manipulation. The exploit leverages a Magento\Customer\Model\Session\Proxy object's setCustomerId function to inject arbitrary customer IDs into PHP sessions, enabling attackers to impersonate any customer by crafting malicious session cookies. Organizations should patch immediately and monitor for unauthorized attempts to manipulate sessions targeting Magento installations.