An unauthenticated code injection vulnerability in mjperpinosa stumasy enables remote attackers to execute arbitrary code, creating a critical risk of full system compromise.

The application utilizes the 'eval' function within 'application/pages/imba_calculator/calculate.php' without proper input validation. This allows unauthenticated remote attackers to pass malicious payloads into the 'mathematical_sentence' argument, resulting in arbitrary code execution.

The ability for an unauthenticated attacker to execute arbitrary code represents the highest level of risk, as it allows for complete system takeover. With a CVSS score of 7.3, this flaw enables attackers to install backdoors, exfiltrate sensitive data, or use the compromised server as a pivot point for further network attacks, leading to severe operational and security consequences.

Immediate Action: Given the dangerous use of 'eval', developers should immediately replace the function with a safe mathematical expression parser or implement strict input validation to prevent non-mathematical characters from being processed.

Proactive Monitoring: Monitor system logs for unauthorized processes or unexpected file creation events emanating from the web server user account.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block payloads containing common code injection patterns, such as PHP-style execution commands, submitted to the application.

Public Exploit Available: True

Due to the nature of code injection via 'eval', this vulnerability should be remediated with the highest urgency. If an immediate code fix cannot be deployed, the application should be taken offline or strictly firewalled to prevent unauthorized external access until the underlying code-execution flaw is resolved.