Session deserialization RCE via serialize_handler mismatch (no LFI)

Exploits the interaction between php_serialize and php session handlers:
when one endpoint writes sessions with php_serialize (Laravel, Symfony
default) and another reads with the php handler (PHP default), injected
pipe characters cause arbitrary deserialization at session_start().

12 built-in POP chains covering current and legacy library versions:
- monolog3-fw: Monolog 3.0+ (tested 3.12.1, latest)
- laravel10-cmd/fw: illuminate 10.0-13.x+ (tested v13.38.0, latest)
- monolog-cmd/fw: Monolog 1.17.2-2.x
- laravel-cmd/fw: illuminate 5.4-8.x
- guzzle-fw: Guzzle 4.0-7.x
- symfony-cmd/fw: Symfony 2.6-4.4.18
- wordpress-cmd/fw: WordPress 6.4.0-6.4.1

All chains tested end-to-end through the full HTTP exploit flow on
PHP 8.3. Accepts custom phpggc chains via --chain-file.

README.md

@@ -25,6 +25,7 @@ against `cleanup=1`, the poisoned session file is includable via LFI for RCE.
 |--------|--------|-------------|
 | `cve-2026-109618/exploit.py` | Unpatched PHP | OOM → session persistence → LFI → RCE |
 | `cve-2026-109619/exploit.py` | Unpatched PHP | Session poisoning (direct + race) → LFI → RCE |
+| `session-deser/exploit.py` | Any PHP | Handler mismatch → deserialization → RCE **(no LFI)** |
 | `wordpress-exploit/exploit_wp.py` | WordPress | Auto-detecting wrapper for both CVEs |
 | `bypass/race_bypass_patched.py` | Patched PHP | TOCTOU race — session data on disk during upload |
 | `bypass/rlimit_bypass_patched.py` | Patched PHP | mmap() failure via RLIMIT_AS bypasses the patch |
@@ -70,6 +71,35 @@ python3 bypass/procfd_bypass_hardened.py -t http://target/app.php --cmd 'id' --p
 All exploits support `--cmd`, `--lhost`/`--lport` (reverse shell), and `--trigger-only`.
 Use `--session-path` and `--lfi-param` to override auto-detection.
 
+## Session Deserialization (No LFI)
+
+`session-deser/exploit.py` exploits `session.serialize_handler` mismatches
+for RCE without any LFI vulnerability. When one endpoint uses `php_serialize`
+(Laravel, Symfony default) and another uses the `php` handler (PHP default),
+the pipe character in session data triggers arbitrary deserialization.
+
+Requires a deployment where two endpoints share session storage but use
+different handlers. This occurs when a framework application coexists with
+non-framework PHP on the same server (phpMyAdmin, admin scripts, legacy code).
+
+Built-in POP chains for current library versions:
+
+| Chain | Library | Tested version |
+|---|---|---|
+| `monolog3-fw` | monolog/monolog 3.0+ | 3.12.1 (latest) |
+| `laravel10-cmd/fw` | illuminate 10.0-13.x+ | v13.38.0 (latest) |
+
+Plus legacy chains for Monolog 2.x, Laravel 5.4-8.x, Guzzle 4.0-7.x,
+Symfony 2.6-4.4.18, and WordPress 6.4.0-6.4.1. Accepts custom phpggc chains
+via `--chain-file`. See `session-deser/README.md` for details.
+
+```bash
+python3 session-deser/exploit.py \
+    --inject-url http://target/laravel-endpoint.php \
+    --trigger-url http://target/legacy-script.php \
+    --chain laravel10-cmd --cmd 'id'
+```
+
 ## Patch Bypass Findings
 
 The PHP 8.4.27 patch has three confirmed bypass paths to RCE: