CVE-2025-3040
📋 TL;DR
CVE-2025-3040 is a critical unrestricted file upload vulnerability in Project Worlds Online Time Table Generator 1.0. Attackers can remotely upload malicious files via the /admin/add_student.php endpoint's 'pic' parameter, potentially leading to server compromise. Organizations using this software are affected.
💻 Affected Systems
- Project Worlds Online Time Table Generator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, or ransomware deployment
Likely Case
Webshell upload enabling persistent backdoor access and data exfiltration
If Mitigated
File upload blocked or sanitized, limiting impact to failed upload attempts
🎯 Exploit Status
Exploit details publicly disclosed on GitHub; simple file upload manipulation required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider removing or replacing the software entirely.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
allRestrict access to /admin/add_student.php via web server configuration
# Apache: RewriteRule ^admin/add_student\.php$ - [F]
# Nginx: location ~ /admin/add_student\.php$ { deny all; }
Implement file upload restrictions
allAdd server-side validation for file uploads (extension, MIME type, size)
🧯 If You Can't Patch
- Remove or disable the Online Time Table Generator application
- Implement network segmentation and restrict access to affected systems
🔍 How to Verify
Check if Vulnerable:
Check if /admin/add_student.php exists and accepts file uploads without proper validationCheck Version:
Check application version in source code or documentationVerify Fix Applied:
Attempt to upload a malicious file (e.g., .php shell) and verify it's rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/add_student.php
- Uploads of executable file types (.php, .exe, .jsp)
Network Indicators:
- POST requests to /admin/add_student.php with file uploads
- Subsequent suspicious requests to uploaded files
SIEM Query:
web.url = "*/admin/add_student.php*" AND http.method = POST AND http.content_type contains "multipart/form-data"