CVE-2026-14751 Overview
CVE-2026-14751 is a SQL injection vulnerability in the mjperpinosa/stumasy project, a PHP-based student management application. The flaw exists in the Notes_controller::search_scratch_data function within application/PHP/objects/notes/search_scratch_data.php. Attackers can manipulate the field_name argument to inject arbitrary SQL statements. The project uses a rolling release model, so no fixed version identifiers are available. A public exploit has been disclosed, and the maintainer has not responded to the upstream issue report at the time of publication.
Critical Impact
Authenticated remote attackers can inject SQL through the field_name parameter to read, modify, or exfiltrate application database contents.
Affected Products
- mjperpinosa/stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be
- application/PHP/objects/notes/search_scratch_data.php
- Rolling release — no discrete version numbers published
Discovery Timeline
- 2026-07-05 - CVE-2026-14751 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14751
Vulnerability Analysis
The vulnerability is classified under [CWE-74] as improper neutralization of special elements in output used by a downstream component, and manifests as SQL injection. The affected code path lives in Notes_controller::search_scratch_data, which accepts a client-supplied field_name argument and incorporates it into a SQL query without sufficient sanitization or parameterization. Because field_name is used to reference a column, common defenses such as prepared statement bind parameters do not automatically apply. Attackers that can reach the endpoint over the network with a low-privileged account can alter query structure to bypass intended data access boundaries. The public exploit lowers the barrier to abuse, though scope remains constrained to the application's database.
Root Cause
The root cause is direct concatenation of untrusted request input into a dynamic SQL statement. The field_name parameter is not validated against an allowlist of legitimate column identifiers before being embedded in the query. This design decision transfers query control from the application to the caller.
Attack Vector
Exploitation is remote and requires low privileges with no user interaction. An authenticated user sends a crafted HTTP request to the search endpoint backed by Notes_controller::search_scratch_data, supplying a field_name value that terminates the intended identifier and injects additional SQL clauses. Successful injection can be used to enumerate schema, extract records, or manipulate stored data within the confines of the database user's permissions.
No verified proof-of-concept code is included here. Technical details are available in the GitHub PoC Repository and the VulDB entry for CVE-2026-14751.
Detection Methods for CVE-2026-14751
Indicators of Compromise
- HTTP requests to routes handled by Notes_controller::search_scratch_data containing SQL metacharacters (', --, ;, UNION, SELECT) in the field_name parameter.
- Web server or application logs showing unusual field_name values that do not match legitimate column identifiers.
- Database error messages referencing syntax errors near unexpected identifiers, correlated with requests to the notes search endpoint.
Detection Strategies
- Deploy web application firewall rules that inspect the field_name parameter and reject non-alphanumeric values.
- Enable database query logging and alert on queries originating from the notes controller that contain nested SELECT, UNION, or comment sequences.
- Compare application access logs against an allowlist of expected field_name values and flag deviations.
Monitoring Recommendations
- Correlate authentication events with subsequent access to search_scratch_data.php to identify low-privileged accounts probing the endpoint.
- Monitor for spikes in response size or query duration from the notes search endpoint, which can indicate blind or UNION-based extraction.
- Track outbound traffic from the database host for anomalous exfiltration patterns following suspicious query activity.
How to Mitigate CVE-2026-14751
Immediate Actions Required
- Restrict access to the notes search functionality to trusted users until a fix is available upstream.
- Apply a virtual patch at the web application firewall to reject requests where field_name contains non-identifier characters.
- Audit database accounts used by the application and reduce their privileges to the minimum required for normal operation.
Patch Information
No vendor patch is available. The project uses a rolling release and the maintainer has not responded to GitHub Issue #7. Track the upstream repository for future commits addressing the Notes_controller::search_scratch_data function.
Workarounds
- Modify search_scratch_data.php to validate field_name against a hardcoded allowlist of permitted column names before use.
- Refactor the query to use parameterized statements for values and static string mapping for identifiers.
- Disable or remove the scratch data search feature if it is not required in your deployment.
# Example WAF ModSecurity rule to block non-identifier field_name values
SecRule ARGS:field_name "!@rx ^[A-Za-z_][A-Za-z0-9_]{0,63}$" \
"id:1014751,phase:2,deny,status:400,\
msg:'CVE-2026-14751: invalid field_name parameter'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
