CVE-2025-2659
📋 TL;DR
This critical SQL injection vulnerability in Project Worlds Online Time Table Generator 1.0 allows remote attackers to execute arbitrary SQL commands via the 'e' parameter in /student/index.php. This affects all installations of version 1.0, potentially enabling unauthorized database access, data manipulation, or system compromise.
💻 Affected Systems
- Project Worlds Online Time Table Generator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chain
Likely Case
Unauthorized access to sensitive student/timetable data, potential privilege escalation, and database manipulation
If Mitigated
Limited impact with proper input validation and WAF rules blocking SQL injection patterns
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with proper input validation and parameterized queries.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize the 'e' parameter in /student/index.php
Edit /student/index.php to add: $e = mysqli_real_escape_string($connection, $_GET['e']);
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns targeting the /student/index.php endpoint
Add ModSecurity rule: SecRule ARGS:e "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Block external access to /student/index.php via firewall rules or .htaccess
- Implement network segmentation to isolate the vulnerable system from sensitive data
🔍 How to Verify
Check if Vulnerable:
Test by accessing /student/index.php?e=1' OR '1'='1 and checking for SQL errors or unexpected behaviorCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Attempt SQL injection payloads against the patched endpoint and verify they are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in PHP/application logs
- Unusual database queries from web server IP
- Multiple failed parameter manipulation attempts
Network Indicators:
- HTTP requests to /student/index.php with SQL keywords in parameters
- Unusual database port traffic from web server
SIEM Query:
source="web_logs" AND uri="/student/index.php" AND (param="e" AND value MATCHES "(?i)(union|select|insert|delete|update|drop|--|#|;)")