The vulnerability in the goodoneuz/pay-uz Laravel package exists in the /payment/api/editable/update endpoint. The endpoint is exposed via Route::any() without authentication middleware, allowing unauthenticated HTTP requests to reach it. User-provided input is written directly as content into PHP hook files using file_put_contents(), and those files are later included with require() during normal payment processing. This directly enables an attacker to inject and execute arbitrary PHP code, resulting in remote code execution and full compromise of the application’s confidentiality, integrity and availability.

All instances of the goodoneuz/pay-uz package with version 2.2.24 or earlier are affected. The vendor’s documentation indicates that the issue is present only in releases up to 2.2.24; no specific patch has been published yet for newer versions. The lack of a precise affected version list means that any deployment using the vulnerable package should be considered at risk unless the application is known to use a version newer than 2.2.24.

The CVSS score is 10.0, reflecting a high‑severity exploit with remote impact. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw by sending an unauthenticated request to the exposed endpoint and supplying malicious PHP payload as part of the request body or query parameters. The absence of authentication or input validation creates a straightforward path to overwrite existing hook files and execute code during the payment workflow.