Does the exploit need a framework like laravel or can it work with just plain php

No, this happens sometime in the request parsing process, any exposed php URL would be vulnerable.