CVE-2025-2660: Online Time Table Generator SQLi Flaw

CVE-2025-2660 Overview

CVE-2025-2660 is a SQL injection vulnerability in Projectworlds Online Time Table Generator 1.0. The flaw resides in the /admin/index.php file, where the e parameter is passed to a database query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and requires no authentication or user interaction. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is classified under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL into the admin interface, enabling read or modification of backend database contents.

Affected Products

Projectworlds Online Time Table Generator 1.0
Component: projectworlds:online_time_table_generator
File path: /admin/index.php (parameter e)

Discovery Timeline

2025-03-23 - CVE-2025-2660 published to NVD
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-2660

Vulnerability Analysis

The vulnerability exists in the administrative interface of Projectworlds Online Time Table Generator 1.0. The /admin/index.php script accepts an HTTP parameter named e and concatenates its value into a SQL query without applying parameterized queries or input validation. An attacker can supply crafted SQL syntax through this parameter to alter the structure of the executed query.

Because the entry point is the admin index page and the attack is reachable over the network without credentials, an unauthenticated remote attacker can interact with the vulnerable endpoint directly. Successful exploitation can disclose database contents, including administrative credentials, or allow tampering with stored timetable and user records.

The issue is consistent with [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (general injection). Public disclosure of the exploit details, referenced in the GitHub Issue Discussion and VulDB #300676, lowers the technical barrier for exploitation.

Root Cause

The root cause is the direct inclusion of user-supplied input from the e parameter into a SQL statement. The application does not use prepared statements, parameter binding, or input validation routines. No allowlist filtering is applied before the value reaches the database driver.

Attack Vector

The attack vector is remote and network-based. An attacker sends a crafted HTTP request to /admin/index.php with a malicious value for the e parameter. No authentication, privileges, or user interaction is required. Typical payloads use boolean-based, union-based, or time-based SQL injection techniques to extract data from the underlying MySQL database. Refer to the VulDB CTI entry #300676 for additional technical context.

Detection Methods for CVE-2025-2660

Indicators of Compromise

HTTP requests to /admin/index.php containing SQL meta-characters in the e parameter, such as single quotes, UNION SELECT, SLEEP(, or -- comment sequences.
Web server access logs showing repeated GET or POST requests to /admin/index.php?e= with abnormally long or encoded values.
Database error messages or anomalous query latency originating from the admin endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect the e parameter for SQL injection patterns on requests targeting /admin/index.php.
Enable database query logging and alert on unusual UNION, INFORMATION_SCHEMA, or BENCHMARK statements issued by the application service account.
Correlate web server, application, and database logs to identify reconnaissance patterns against the admin interface.

Monitoring Recommendations

Monitor outbound traffic from the web server for unexpected data egress that may indicate exfiltration.
Track failed and successful admin login attempts following suspicious requests to /admin/index.php.
Forward web and database telemetry to a centralized SIEM for retention and correlation against known SQL injection tradecraft.

How to Mitigate CVE-2025-2660

Immediate Actions Required

Restrict network access to /admin/index.php using IP allowlisting or VPN-only access until a fix is applied.
Place the application behind a WAF configured to block SQL injection payloads targeting the e parameter.
Audit the application's database accounts and rotate any credentials that may have been exposed.

Patch Information

No vendor patch is currently listed in the NVD entry or referenced advisories for Projectworlds Online Time Table Generator 1.0. Organizations should monitor the GitHub issue tracker and the VulDB submission record for updates. If a fix is not released, consider migrating to a maintained alternative or applying source-level remediation by replacing direct query concatenation with parameterized queries.

Workarounds

Modify the application source to validate the e parameter against a strict allowlist of expected values and use prepared statements with bound parameters.
Apply the principle of least privilege to the database user account so it cannot execute administrative SQL operations such as DROP or INFORMATION_SCHEMA reads.
Disable or remove the admin endpoint if it is not required in the current deployment.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on the vulnerable parameter
SecRule ARGS:e "@detectSQLi" \
    "id:1002660,phase:2,deny,status:403,\
    msg:'CVE-2025-2660 SQLi attempt on /admin/index.php parameter e',\
    tag:'cve/CVE-2025-2660'"