CVE-2026-31843

Summary

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

Affected Software

Weaknesses

• CWE-284: CWE-284 Improper Access Control leading to unauthorized modification of executable application files

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://github.com/shaxzodbek-uzb/pay-uz
• https://github.com/goodoneuz/pay-uz/blob/master/src/routes/web.php
• https://github.com/goodoneuz/pay-uz/blob/master/src/Http/Controllers/ApiController.php
• https://packagist.org/packages/goodoneuz/pay-uz

• ←Previous
• Next→