Executive brief
ProjectWorlds Online Time Table Generator is a PHP/MySQL web application used by schools and universities to automatically create class schedules. An attacker can delete critical records—including students, teachers, courses, and timetables—by sending HTTP requests directly to unprotected administrative endpoints without logging in. This allows complete destruction of scheduling data, rendering the system unusable and causing operational disruption.
Technical details
The vulnerability is a broken access control flaw (CWE-306, CWE-862) in multiple administrative deletion scripts under /admin/ that lack authentication checks. Each delete endpoint (e.g., /admin/deletestudent.php, /admin/deleteteacher.php, /admin/deletesubject.php) accepts identifier parameters via HTTP GET requests and executes SQL DELETE operations directly without verifying an active admin session or authorization. An unauthenticated remote attacker can invoke these endpoints over the network with crafted parameters to delete arbitrary database records. The root cause is the complete absence of session validation; scripts only include database configuration and perform deletion without any session_start() or role-based access control checks. No patch is mentioned in the advisory, and the recommended fix is to enforce session authentication at the entry point of each delete script.
Affected products
- ProjectWorlds Online Time Table Generator 1.0
Timeline
- 2025-12-22: disclosed: Vulnerability discovered by MinhKhoa
- 2026-02-18: advisory: Published to NVD