CVE-2024-10447 Overview
CVE-2024-10447 is a SQL injection vulnerability in Project Worlds Online Time Table Generator 1.0. The flaw resides in the /timetable/staff/staffdashboard.php?info=updateprofile endpoint. Attackers can manipulate the n parameter to inject arbitrary SQL statements into backend queries. The vulnerability is remotely exploitable and requires only low-privileged authenticated access. A public proof-of-concept has been published on GitHub, increasing the likelihood of opportunistic exploitation against exposed instances. The weakness is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated remote attackers can inject SQL statements through the n parameter to read, modify, or exfiltrate database contents in Project Worlds Online Time Table Generator 1.0.
Affected Products
- Project Worlds Online Time Table Generator 1.0
- CPE: cpe:2.3:a:projectworlds:online_time_table_generator:1.0:*:*:*:*:*:*:*
- Vulnerable component: staffdashboard.php (staff profile update handler)
Discovery Timeline
- 2024-10-28 - CVE-2024-10447 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10447
Vulnerability Analysis
The vulnerability exists in the staff profile update workflow of Project Worlds Online Time Table Generator 1.0. The staffdashboard.php script accepts the info=updateprofile action and processes the n parameter without proper sanitization or parameterized query enforcement. Because the input is concatenated directly into a SQL statement, attackers can break out of the intended query context and append their own SQL fragments.
Exploitation requires network access to the application and a low-privileged staff account. Once authenticated, an attacker submits a crafted request modifying the n parameter to inject payloads such as UNION SELECT statements or boolean-based blind conditions. Successful exploitation allows disclosure of database records, tampering with staff and schedule data, and potentially authentication bypass through credential extraction.
Root Cause
The root cause is the absence of input validation and prepared statements in the profile update handler. The application interpolates the n request parameter directly into a SQL query string, which is the classic pattern described by [CWE-89]. No allow-listing, type casting, or bound parameters are applied before the query executes against the database.
Attack Vector
The attack is delivered over HTTP against the staff dashboard endpoint. An attacker sends a request such as GET /timetable/staff/staffdashboard.php?info=updateprofile&n=<payload> while holding a valid session cookie. The injected payload executes within the context of the application's database user. A public proof-of-concept is available in the GitHub PoC for CVE, which documents the request structure and payload used to trigger the flaw.
See the VulDB #282007 Details entry for additional technical context on the exploitation path.
Detection Methods for CVE-2024-10447
Indicators of Compromise
- HTTP requests to /timetable/staff/staffdashboard.php containing info=updateprofile with SQL metacharacters in the n parameter, such as single quotes, UNION, SELECT, --, or SLEEP(.
- Unexpected database errors or long response times originating from the staff dashboard endpoint.
- Web server logs showing repeated profile update requests from a single session with variations of the n parameter.
Detection Strategies
- Deploy web application firewall (WAF) rules that flag SQL injection payloads targeting the n query parameter on the staff dashboard route.
- Inspect database query logs for malformed statements referencing staff profile columns or generating syntax errors.
- Correlate authentication events with subsequent anomalous query patterns from the same session identifier.
Monitoring Recommendations
- Enable verbose logging on the PHP application and MySQL/MariaDB backend to capture full query text for forensic review.
- Alert on outbound data transfers from the database host that exceed baseline volumes following staff dashboard activity.
- Monitor for new or modified rows in staff and credential tables outside of expected administrative workflows.
How to Mitigate CVE-2024-10447
Immediate Actions Required
- Restrict network access to the Online Time Table Generator application to trusted networks or place it behind a VPN until a patch is applied.
- Disable or gate the staffdashboard.php profile update functionality if it is not required for operations.
- Rotate database credentials and audit staff accounts for signs of unauthorized profile changes.
Patch Information
No vendor patch has been published for Project Worlds Online Time Table Generator 1.0 at the time of writing. No vendor advisory URLs are listed in the enriched CVE data. Organizations running this software should treat it as unmaintained and consider migration to a supported alternative. Consult VulDB #282007 for updates on remediation status.
Workarounds
- Introduce a WAF or reverse proxy rule that blocks SQL metacharacters in the n parameter of staffdashboard.php requests.
- Refactor the vulnerable query to use parameterized statements with PDO or mysqli_prepare if source code modifications are feasible.
- Enforce least-privilege database accounts so the application user cannot access sensitive tables or execute administrative statements.
- Remove the application from public-facing infrastructure and expose it only to authenticated internal users through a jump host.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
