Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-54236 — Adobe Magento SessionReaper LFI Vulnerability | Kitploit
Tools/GitHubGitHub/dx3iz/cve-2025-54236
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubdx3iz/cve-2025-54236

CVE-2025-54236

Adobe Magento SessionReaper LFI Vulnerability

View Repository
2 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
image

Adobe Magento SessionReaper LFI PoC

A simple Python proof-of-concept demonstrating the CVE-2025-54236 (SessionReaper) vulnerability affecting vulnerable Adobe Magento versions.

Educational and authorized security testing only.

Features

  • Automatic target URL normalization
  • Random form_key generation
  • File upload request automation
  • Uploaded file verification
  • Saves successful uploads to success.txt
  • Saves false positives to falsepositive.txt
  • Connection timeout & retry support

Affected Versions

  • Magento 2.4.9-alpha2
  • Magento 2.4.8-p2
  • Magento 2.4.7-p7
  • Magento 2.4.6-p12
  • Magento 2.4.5-p14
  • Magento 2.4.4-p15
  • Earlier vulnerable releases

Requirements

  • Python 3.x

Install dependencies:

root@kitploit:~
Download Tool
pip install requests urllib3

Usage

root@kitploit:~
python ankamagento.py https://target.com payload.txt

Example:

root@kitploit:~
python ankamagento.py https://example.com dxeiz.txt

Output

  • success.txt → Successfully verified uploads
  • falsepositive.txt → Uploads that could not be verified

Disclaimer

This project is provided for educational purposes and authorized security assessments only. The author assumes no responsibility for misuse or unauthorized use of this software.