CVE-2024-10446 Overview
CVE-2024-10446 is a SQL injection vulnerability in Project Worlds Online Time Table Generator 1.0. The flaw exists in the /timetable/admin/admindashboard.php endpoint when processing requests with the info=add_course parameter. Attackers can manipulate the c argument to inject arbitrary SQL statements against the backend database. The vulnerability is exploitable remotely over the network and requires low-level authentication. Public disclosure of exploitation details has occurred, increasing exposure risk for deployed instances. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
Authenticated remote attackers can inject SQL statements through the c parameter in admindashboard.php, exposing database contents and potentially enabling unauthorized data modification.
Affected Products
- Projectworlds Online Time Table Generator 1.0
- CPE: cpe:2.3:a:projectworlds:online_time_table_generator:1.0:*:*:*:*:*:*:*
- Component: projectworlds:online_time_table_generator
Discovery Timeline
- 2024-10-28 - CVE-2024-10446 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10446
Vulnerability Analysis
The vulnerability resides in the administrative dashboard component of Project Worlds Online Time Table Generator 1.0. The admindashboard.php script processes an info=add_course action and consumes the c query parameter without proper sanitization or parameterized query enforcement. Because user-controlled input flows directly into an SQL statement, an attacker can alter query semantics to read, modify, or exfiltrate database contents.
Exploitation requires network access to the application and a low-privileged account on the admin interface. No user interaction is required. The public disclosure of proof-of-concept material via a GitHub PoC repository increases the practical risk that opportunistic attackers will attempt exploitation.
Root Cause
The root cause is missing input validation and lack of prepared statements when constructing the SQL query for the add course workflow. The c parameter is concatenated into the SQL statement, allowing injection of operators such as UNION, OR, or stacked queries depending on backend behavior. This class of flaw is categorized as [CWE-89].
Attack Vector
An attacker with authenticated access to the administrative dashboard sends a crafted HTTP request to /timetable/admin/admindashboard.php?info=add_course with a malicious payload in the c parameter. The backend concatenates this value into a SQL statement, causing the injected clauses to execute against the database. Successful exploitation can disclose stored records, modify course data, or enumerate database schema.
No verified exploit code is republished here. Refer to the VulDB entry #282006 and the linked PoC for technical specifics.
Detection Methods for CVE-2024-10446
Indicators of Compromise
- HTTP requests to /timetable/admin/admindashboard.php?info=add_course containing SQL metacharacters such as ', --, UNION SELECT, or OR 1=1 in the c parameter.
- Web server access logs showing repeated requests to the admindashboard.php endpoint with malformed or encoded c values.
- Unexpected database errors or anomalous query response times originating from the timetable application backend.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule set that inspects the c query parameter on admindashboard.php for SQL injection signatures.
- Enable database query logging and alert on syntactically invalid queries or unusual UNION/INFORMATION_SCHEMA access from the application user.
- Correlate authentication events with subsequent malformed requests to identify low-privileged accounts probing the admin interface.
Monitoring Recommendations
- Forward web server and database logs into a centralized analytics platform for pattern matching on SQL injection indicators.
- Monitor for privilege escalation or lateral database access following successful requests to admindashboard.php.
- Track outbound data volumes from the database server to identify potential exfiltration following exploitation attempts.
How to Mitigate CVE-2024-10446
Immediate Actions Required
- Restrict network access to the /timetable/admin/ path using IP allow-listing or VPN-only reachability until a fix is applied.
- Rotate administrative credentials and audit accounts that hold access to the timetable admin dashboard.
- Review database logs for signs of prior exploitation, focusing on queries originating from the application service account.
Patch Information
At the time of the last NVD update on 2026-06-17, no vendor advisory or official patch has been published for Project Worlds Online Time Table Generator 1.0. Operators should monitor the VulDB entry #282006 and vendor channels for updates. If no patch becomes available, consider migrating to a maintained scheduling application.
Workarounds
- Place the application behind a WAF with rules blocking SQL metacharacters in the c parameter of admindashboard.php.
- Modify the source of admindashboard.php to use parameterized queries or prepared statements for the add_course action, and cast c to its expected data type before use.
- Enforce least-privilege database accounts so the application user cannot access unrelated schemas or perform destructive operations.
- Disable the add_course administrative flow if it is not required in the current deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
