Stumasy (<= 327d1b0f2915ba79d7ef8ebb74553e987609d9be) - CraftedSignal Threat Feed

CVE-2026-14753: mjperpinosa stumasy Authorization Bypass

hello@craftedsignal.io — Sun, 05 Jul 2026 14:21:51 +0000

A significant authorization bypass vulnerability, identified as CVE-2026-14753, has been discovered in mjperpinosa stumasy, affecting all versions up to and including commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This flaw exists within an unspecified function of the /PHP/objects/notes file, part of the Note Handler/Assignment Handler component. Exploitation occurs when a remote attacker manipulates the assignment_item_id argument, leading to an authorization bypass. The vulnerability is considered critical due to a publicly available exploit, enabling immediate threat to affected systems. As mjperpinosa stumasy utilizes continuous delivery with rolling releases, specific version details for affected or patched releases are not available, complicating remediation efforts. While the project was notified via an issue report, no response or fix has been released to date, making immediate detection and mitigation crucial for defenders.

Attack Chain

An attacker identifies a publicly accessible instance of mjperpinosa stumasy.
The attacker crafts a malicious HTTP request targeting the /PHP/objects/notes endpoint of the application.
Within this request, the attacker manipulates the assignment_item_id argument to an unauthorized or unintended value.
The vulnerable stumasy application processes the malformed request through its Note Handler/Assignment Handler component.
Due to the flaw, the application's authorization checks are bypassed, granting the attacker unauthorized access.
The attacker can now perform actions or access data that would normally require higher privileges or proper authorization within the stumasy application.

Impact

The successful exploitation of CVE-2026-14753 allows a remote attacker to bypass authorization controls within mjperpinosa stumasy. This can lead to unauthorized access to sensitive notes, assignments, or potentially other functionalities handled by the affected component. Given the nature of an authorization bypass, an attacker could escalate privileges, modify or delete data, or access information they are not permitted to see, depending on the context of the Note Handler/Assignment Handler. The availability of a public exploit significantly increases the risk of widespread attacks against unpatched or unmitigated instances, potentially compromising the integrity and confidentiality of data managed by the stumasy application.

Recommendation

If mjperpinosa releases a fix, apply it immediately to all stumasy instances due to the public exploit (CVE-2026-14753).
Monitor web server access logs for suspicious HTTP requests targeting the /PHP/objects/notes path that include unusual or malformed assignment_item_id parameters.
Deploy a Web Application Firewall (WAF) to detect and block requests that attempt to manipulate the assignment_item_id argument, looking for patterns indicative of authorization bypass attempts against the Note Handler/Assignment Handler component.
Regularly review audit logs for the stumasy application for any unauthorized actions or access patterns observed within the Note Handler/Assignment Handler component.

CVE-2026-14750 — SQL Injection in mjperpinosa stumasy via Password Argument

hello@craftedsignal.io — Sun, 05 Jul 2026 14:21:02 +0000

A critical security flaw, identified as CVE-2026-14750, has been discovered in the mjperpinosa stumasy web application, affecting all versions up to and including commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The vulnerability is a remote SQL injection residing within the Notes_controller::accessing_dictionary_authorization function, specifically through the manipulation of the 'Password' argument in the file application/PHP/objects/notes/accessing_dictionary_authorization.php. This flaw permits remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or even full compromise of the underlying database and host server. An exploit for this vulnerability has been publicly released, making affected systems highly susceptible to immediate attack. The project maintainers were notified of the issue but have not yet released a patch or responded to the report.

Attack Chain

Attacker identifies a publicly accessible instance of mjperpinosa stumasy.
Attacker crafts a malicious HTTP POST request targeting the application/PHP/objects/notes/accessing_dictionary_authorization.php endpoint.
The request includes a specially crafted 'Password' argument containing SQL injection payloads (e.g., ' OR 1=1 --, UNION SELECT).
The Notes_controller::accessing_dictionary_authorization function processes the vulnerable 'Password' argument without proper sanitization.
The application's backend database executes the attacker's embedded SQL query due to the injection.
Depending on the payload, the attacker bypasses authentication, extracts sensitive database contents, or manipulates existing data.
With sufficient database privileges, the attacker may write arbitrary files (e.g., web shells) to the server, achieving remote code execution.
The attacker achieves unauthorized access to the application's data or the underlying server, enabling further reconnaissance, data exfiltration, or system compromise.

Impact

Successful exploitation of CVE-2026-14750 grants unauthenticated remote attackers the ability to execute arbitrary SQL commands against the mjperpinosa stumasy application's database. This can lead to severe consequences including, but not limited to, unauthorized access to sensitive user data, complete database compromise, modification or deletion of application data, and potential remote code execution on the server if the database user has file system privileges (e.g., using INTO OUTFILE). Given the public availability of an exploit, organizations using affected versions of stumasy face an immediate and high risk of data breaches, system defacement, or complete server takeover.

Recommendation

Prioritize patching mjperpinosa stumasy to a secure version as soon as one becomes available.
Deploy the Sigma rule provided in this brief to your SIEM to detect attempts at SQL injection against your web servers.
Implement a Web Application Firewall (WAF) to filter and block malicious SQL injection payloads targeting HTTP request parameters like Password.
Review web server access logs for the application/PHP/objects/notes/accessing_dictionary_authorization.php endpoint for unusual HTTP POST requests or suspicious query parameters.

CVE-2026-14749: mjperpinosa stumasy Code Injection Vulnerability

hello@craftedsignal.io — Sun, 05 Jul 2026 13:22:39 +0000

A critical code injection vulnerability, identified as CVE-2026-14749, exists in mjperpinosa stumasy, affecting versions up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This flaw resides within the eval function in the application/pages/imba_calculator/calculate.php file, allowing remote attackers to execute arbitrary code by manipulating the mathematical_sentence argument. The vulnerability has a CVSS v3.1 Base Score of 7.3 and is publicly exploitable. While the product utilizes a rolling release strategy, preventing the enumeration of specific affected or patched versions, the vendor has not yet responded to the reported issue, leaving deployments exposed. Defenders must be aware that readily available exploits facilitate widespread targeting of unpatched instances.

Attack Chain

An attacker identifies a public-facing instance of mjperpinosa stumasy.
The attacker crafts an HTTP POST or GET request targeting the application/pages/imba_calculator/calculate.php endpoint on the vulnerable server.
The request includes a specially crafted mathematical_sentence parameter containing arbitrary PHP code (e.g., 1+1; system('id');).
The vulnerable eval function in application/pages/imba_calculator/calculate.php processes the mathematical_sentence argument without proper sanitization.
The malicious PHP code embedded within the mathematical_sentence argument is executed by the server process.
The server's HTTP response may reveal the output of the executed command, confirming successful code injection and providing initial access.
The attacker leverages this remote code execution to download further malware, establish persistence, exfiltrate sensitive data, or perform other malicious actions on the compromised server.

Impact

The exploitation of CVE-2026-14749 grants remote attackers arbitrary code execution capabilities on affected mjperpinosa stumasy instances. Given the public availability of an exploit and the vendor's non-response to the reported issue, organizations running this software are at high risk. Successful exploitation can lead to complete system compromise, data theft, defacement, or further lateral movement within the network, potentially impacting critical business operations and exposing sensitive information to unauthorized parties.

Recommendation

Deploy the Detects CVE-2026-14749 Exploitation — stumasy Code Injection Sigma rule to your SIEM and tune for your environment to identify exploitation attempts.
Implement a Web Application Firewall (WAF) to detect and block suspicious requests containing shell metacharacters targeting application/pages/imba_calculator/calculate.php as identified by the Detects CVE-2026-14749 Exploitation — stumasy Code Injection Sigma rule.
Monitor web server access logs for requests to application/pages/imba_calculator/calculate.php with unusual mathematical_sentence parameter values, indicating potential code injection attempts.
Prioritize patching or implementing compensating controls for any mjperpinosa stumasy deployments until the vendor releases a fix for CVE-2026-14749.