CVE-2025-5004
📋 TL;DR
CVE-2025-5004 is a critical SQL injection vulnerability in projectworlds Online Time Table Generator 1.0 that allows remote attackers to execute arbitrary SQL commands via the c/subname parameter in /admin/add_course.php. This affects all users running version 1.0 of the software, potentially leading to data theft, modification, or deletion.
💻 Affected Systems
- projectworlds Online Time Table Generator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, privilege escalation, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized access to sensitive timetable data, user information, and potential administrative account takeover.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Requires admin access to reach the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or input validation to the c/subname parameter in add_course.php
Modify /admin/add_course.php to use prepared statements with parameterized queries
Web Application Firewall Rules
allBlock SQL injection patterns targeting the /admin/add_course.php endpoint
Configure WAF to block requests containing SQL keywords to /admin/add_course.php
🧯 If You Can't Patch
- Restrict access to /admin/add_course.php using IP whitelisting or authentication requirements
- Implement database user with minimal privileges for the application
🔍 How to Verify
Check if Vulnerable:
Check if /admin/add_course.php exists and accepts c/subname parameter without proper input validationCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Test SQL injection attempts against the c/subname parameter to ensure they are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Multiple failed login attempts to admin panel
- Unusual database queries from web application
Network Indicators:
- HTTP POST requests to /admin/add_course.php with SQL keywords in parameters
- Unusual outbound database connections
SIEM Query:
source="web_server" AND uri="/admin/add_course.php" AND (param="c/subname" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "INSERT")