CVE-2025-5008
📋 TL;DR
This critical SQL injection vulnerability in Online Time Table Generator 1.0 allows remote attackers to execute arbitrary SQL commands via the 'e' parameter in /admin/add_teacher.php. Attackers can potentially read, modify, or delete database content, and may gain unauthorized access to sensitive information. All users running version 1.0 are affected.
💻 Affected Systems
- projectworlds Online Time Table Generator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive data including teacher information, timetables, and potentially administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to the affected table only.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameter validation and SQL injection protection to /admin/add_teacher.php
Edit /admin/add_teacher.php to implement prepared statements or parameterized queries for the 'e' parameter
Access Restriction
allRestrict access to the vulnerable endpoint
Add authentication requirement to /admin/add_teacher.php or block access via .htaccess: Order Deny,Allow\nDeny from all
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with SQL injection rules
- Isolate the application in a segmented network with strict outbound controls
🔍 How to Verify
Check if Vulnerable:
Check if /admin/add_teacher.php exists and accepts the 'e' parameter without proper input validationCheck Version:
Check the software version in the application interface or configuration filesVerify Fix Applied:
Test the 'e' parameter with SQL injection payloads to confirm they are properly sanitized or blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or SQL errors in web server logs
- Requests to /admin/add_teacher.php with suspicious 'e' parameter values
Network Indicators:
- SQL injection payloads in HTTP requests
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/admin/add_teacher.php" AND (param="e" AND value MATCH "[';]|UNION|SELECT|INSERT|UPDATE|DELETE|DROP")