Description
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| goodoneuz | pay-uz | <= 2.2.24 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | goodoneuz/pay-uz | < 3.0.0 | 3.0.0 | GHSA-m5wg-cjgh-223j |