CVE-2025-2662

CVE-2025-2662 is a critical SQL injection vulnerability in Project Worlds Online Time Table Generator version 1.0. The flaw resides in an unknown function within the file student/studentdashboard.php, where manipulation of the "course" argument triggers the injection. Published on 2025-03-23, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is associated with CWEs-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).

The vulnerability enables remote exploitation over the network with low attack complexity and requires only low privileges, such as those of an authenticated user, with no user interaction needed. Attackers can manipulate the "course" parameter to inject malicious SQL, potentially leading to low-level impacts on confidentiality (e.g., limited data exposure), integrity (e.g., minor unauthorized modifications), and availability (e.g., limited denial of service).

Advisories and details are documented on VulDB (ctiid.300678, id.300678, submit.520503) and GitHub (ydnd/cve/issues/10). The exploit has been publicly disclosed and may be used by attackers.

The vulnerability's public exploit disclosure heightens the risk for unpatched instances of the affected software.