Muhammadiyev Giyosiddin

**Name of the Vulnerable Software and Affected Versions** goodoneuz/pay-uz versions prior to 2.2.25 **Description** A critical issue exists in the `/payment/api/editable/update` endpoint, which is exposed via `Route::any()` without authentication middleware. This allows unauthenticated remote attackers to overwrite existing PHP payment hook files by sending user-controlled input that is directly written into executable files using the `file put contents()` function. These modified files are subsequently executed via `require()` during standard payment processing workflows, leading to remote code execution (RCE), a state where an attacker can execute arbitrary commands on the server. The payment secret token does not provide mitigation for this specific endpoint. **Recommendations** Update goodoneuz/pay-uz to a version newer than 2.2.24. As a temporary workaround, restrict access to the `/payment/api/editable/update` endpoint to minimize the risk of exploitation.