Executive brief
The pay-uz Laravel package, used for integrating national payment systems in Uzbekistan, contains a critical security flaw. An unauthenticated attacker can remotely overwrite internal payment processing files with malicious code. This could lead to a complete takeover of the web server, theft of customer data, or disruption of payment services.
Technical details
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains an improper access control vulnerability in the /payment/api/editable/update endpoint. This endpoint is exposed via Route::any() without any authentication middleware, allowing unauthenticated remote access. The application uses file_put_contents() to write user-controlled input directly into executable PHP payment hook files. Because these files are subsequently executed via require() during standard payment processing workflows, an attacker can achieve remote code execution (RCE). The vulnerability is patched in version 3.0.0.
Affected products
- goodoneuz pay-uz <= 2.2.24
Timeline
- 2026-04-16: disclosed
- 2026-04-16: advisory
- 2026-04-16: patched: Version 3.0.0 released
References
- https://api.github.com/users/shaxzodbek-uzb
- https://github.com/shaxzodbek-uzb
- https://api.github.com/users/shaxzodbek-uzb/gists%7B/gist_id%7D
- https://api.github.com/users/shaxzodbek-uzb/repos
- https://avatars.githubusercontent.com/u/47610909?v=4
- https://api.github.com/users/shaxzodbek-uzb/events%7B/privacy%7D