CVE-2025-2660
📋 TL;DR
This critical SQL injection vulnerability in Project Worlds Online Time Table Generator 1.0 allows remote attackers to execute arbitrary SQL commands via the 'e' parameter in /admin/index.php. This can lead to data theft, modification, or deletion. All users running version 1.0 are affected.
💻 Affected Systems
- Project Worlds Online Time Table Generator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive data exfiltration, privilege escalation to admin, and potential system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to timetable data, user information theft, and potential database corruption.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or minor data exposure.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires access to admin interface but SQL injection is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Apply input validation and parameterized queries to /admin/index.php. Consider migrating to alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation and sanitization for the 'e' parameter in /admin/index.php
Modify /admin/index.php to validate and sanitize the 'e' parameter using prepared statements or proper escaping
Web Application Firewall
allDeploy WAF rules to block SQL injection attempts targeting the 'e' parameter
Add WAF rule: Block requests to /admin/index.php with SQL injection patterns in 'e' parameter
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test /admin/index.php?e=1' OR '1'='1 and observe SQL error or unexpected behaviorCheck Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Test with SQL injection payloads and verify they are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- SQL error messages in application logs
- Multiple failed login attempts to admin interface
- Unusual database queries from application user
Network Indicators:
- HTTP requests to /admin/index.php with SQL keywords in parameters
- Unusual outbound database connections
SIEM Query:
source="web_logs" AND uri="/admin/index.php" AND (param="e" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|exec|--|#|;)")