This article details a real-world RCE vulnerability chain on Adobe Experience Manager (AEM) 6.1, exploiting exposed Felix Console through dispatcher bypass (CVE-2016-0957), default credentials (admin/admin), and malicious OSGi bundle deployment. The author provides step-by-step methodology for gaining code execution without Java knowledge by using pre-built exploitation tools.
A reflected XSS vulnerability was discovered on Philips.com through enabled Adobe Experience Manager debug mode in production, allowing HTML injection via the debug=layout parameter. The attack bypassed ModSecurity and Akamai WAF by using a <body onpointerenter> tag combined with jQuery.getScript() to load external JavaScript, enabling phishing and credential theft from authenticated users.