ProjectWorlds Online Time Table Generator 1.0 Missing Authentication Vulnerability (CVE-2025-70146)

Key Information Vulnerability Summary CVE ID: CVE-2025-70146 Product: Online Time Table Generator 1.0 Vendor: ProjectWorlds Vulnerability Type: Broken Access Control / Missing Authentication Attack Vector: Remote, Unauthenticated CVSS v3.1: 3.1 CWE: CWE-306, CWE-862 Discoverer: MinhKhoa Date: 2025-12-22 Description ProjectWorlds Online Time Table Generator 1.0 contains multiple management deletion scripts located in the /admin/ directory that suffer from incorrect access control and missing authentication vulnerabilities. Since these endpoints do not enforce authentication or authorization checks, remote unauthenticated attackers can directly trigger deletion operations by requesting the scripts with expected identifier parameters. Affected Endpoints (Incomplete List) /admin/deleteteacher.php?teacher_id=... /admin/deletesubject.php?subject_id=... /admin/deletesemester.php?sem_id=... /admin/deletecourse.php?course_id=... /admin/deletestudent.php?stu_id=... /admin/delete_timetable.php?timeschedule_id=... Impact Unauthorized data deletion: Attackers can delete student, teacher, course/department, semester, subject, and timetable entries. Denial of Service: Attackers can disrupt timetable generation and management by deleting core data. Remediation Recommendations 1. Enforce authentication at the beginning of each /admin/delete*.php script. 2. Prefer POST requests with CSRF protection for destructive operations. 3. Use parameterized queries (multi-layer defense).

Goal Reached Thanks to every supporter — we hit 100%!

ProjectWorlds Online Time Table Generator 1.0 Missing Authentication Vulnerability (CVE-2025-70146)