CVE-2026-14749 in stumasy
Summary
by MITRE • 07/05/2026
A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Impacted is the function eval of the file application/pages/imba_calculator/calculate.php. The manipulation of the argument mathematical_sentence leads to code injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/05/2026
This vulnerability represents a critical code injection flaw in the mjperpinosa stumasy application where the eval function in calculate.php processes user-supplied mathematical expressions without proper sanitization. The exploitation occurs through manipulation of the mathematical_sentence argument, which allows attackers to execute arbitrary PHP code on the target system. This type of vulnerability falls under CWE-94, which specifically addresses the execution of arbitrary code due to improper input validation and handling of dynamic code evaluation. The remote attack vector significantly amplifies the risk as attackers can exploit this vulnerability from outside the network without requiring physical access or prior authentication.
The technical implementation of this flaw demonstrates a classic insecure coding practice where user input is directly passed to the eval function without any form of input validation, sanitization, or encoding. When an attacker supplies malicious input to the mathematical_sentence parameter, the application processes this input through eval, effectively executing whatever code the attacker has embedded within the payload. This creates a complete compromise scenario where attackers can perform arbitrary file operations, execute system commands, access sensitive data, or establish persistent backdoors on the affected system.
The operational impact of this vulnerability is severe and multifaceted, encompassing potential data breaches, system compromise, and service disruption. Attackers exploiting this vulnerability could gain full administrative control over the application server, leading to unauthorized data access, modification, or deletion. The rolling release strategy employed by this project complicates remediation efforts as there are no specific version numbers to reference for patching, making it difficult for organizations to assess their risk exposure or implement targeted fixes. This approach also indicates potential gaps in the project's security monitoring and response procedures.
Security practitioners should consider this vulnerability in relation to ATT&CK technique T1059.007 which covers scripting languages including PHP, and T1566 which addresses social engineering through spearphishing with a malicious attachment or link that could deliver payloads exploiting such code injection vulnerabilities. Organizations should implement immediate mitigations including disabling the eval function, implementing strict input validation and sanitization measures, employing web application firewalls, and monitoring for suspicious patterns in the mathematical_sentence parameter usage. The lack of response from the project maintainers after early notification through issue reports highlights the importance of proactive security monitoring and the potential risks associated with open-source projects that may not have adequate security response protocols in place.
The public availability of exploits for this vulnerability significantly increases the risk to organizations using affected versions, as it removes the requirement for advanced technical skills or specialized knowledge to carry out attacks. This makes the vulnerability particularly dangerous in environments where such applications might be exposed to untrusted users or external networks, and underscores the critical need for immediate remediation or compensating controls. The vulnerability's classification as a code injection flaw also means that traditional security controls like input filters may not be sufficient without proper context-aware validation of all dynamic code execution points within the application.