Pay Uz
Monthly
Unauthenticated remote code execution in the goodoneuz/pay-uz Laravel package (all versions through 2.2.24) lets remote attackers overwrite executable PHP payment-hook files through the /payment/api/editable/update endpoint, which is registered via Route::any() with no authentication middleware. User-supplied content is written verbatim with file_put_contents() into PHP files that are later loaded via require() during normal payment processing, so any web-facing deployment can be fully compromised without credentials. CVSS is 10.0 and SSVC rates technical impact as total and the attack as automatable; there is no public exploit identified at time of analysis and EPSS is a modest 0.89% (75th percentile).
Unauthenticated remote code execution in the goodoneuz/pay-uz Laravel package (all versions through 2.2.24) lets remote attackers overwrite executable PHP payment-hook files through the /payment/api/editable/update endpoint, which is registered via Route::any() with no authentication middleware. User-supplied content is written verbatim with file_put_contents() into PHP files that are later loaded via require() during normal payment processing, so any web-facing deployment can be fully compromised without credentials. CVSS is 10.0 and SSVC rates technical impact as total and the attack as automatable; there is no public exploit identified at time of analysis and EPSS is a modest 0.89% (75th percentile).