External risk intelligence

ProjectWorlds Time Table Generator Missing Authentication Allows Unauthorized Administrative Access

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-70146

The vulnerability resides in administrative scripts within a web application that are accessible via direct HTTP requests. As a web-based management interface, such applications are commonly deployed as web services where endpoints, including administrative panels, can be reached over the network, making public-internet-facing exposure a likely deployment scenario.

Missing Authentication

Projectworlds Online Time Table Generator

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects administrative functions within the ProjectWorlds Online Time Table Generator, allowing unauthorized remote access to modify or delete data. Given its critical severity and the potential for unauthenticated access, confirming its presence and relevance within your environment is the primary concern.

Unauthenticated users can alter or remove records.
It impacts administrative control over system data.
Assess if this system is used in your environment.

Attack Path

How an attacker could exploit the issue

An attacker can target administrative scripts in the ProjectWorlds Online Time Table Generator by directly sending HTTP requests. Because authentication is missing, these requests can be made without a valid user session, allowing an unauthenticated remote attacker to perform unauthorized administrative actions such as adding or deleting records, potentially leading to data manipulation and system compromise.

No authentication required.
Directly request administrative scripts.
Unauthorized data modification or deletion.

Live Threat

Current exploitation, exposure, and threat context

Missing authentication in administrative scripts could allow remote attackers to add or delete records by making direct HTTP requests to affected endpoints, bypassing the need for a valid session. This could impact the integrity and availability of the system's data.

Records in the timetable system.
Via direct, unauthenticated HTTP requests.
Unauthorized data modification or deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the ProjectWorlds Online Time Table Generator affects administrative scripts, making them accessible via direct HTTP requests without authentication. Application owners or infrastructure teams responsible for this web application should first identify all instances of the software, determine their exposure (internal vs. external), and assess business criticality. Subsequently, they must coordinate with the appropriate teams, potentially including security and network teams, to plan a phased remediation based on the identified risk, considering vendor coordination or temporary risk reduction measures if immediate patching is not feasible.

Application owners should own the issue.
Verify application exposure and criticality.
Plan remediation or implement mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ProjectWorlds Online Time Table Generator?

It is a web-based software application designed to help educational institutions or organizations create and manage academic schedules. Built using PHP and MySQL, it provides an administrative interface for managing timetable data, which is the specific component impacted by this security flaw.

What does CWE-306 and CWE-862 mean for CVE-2025-70146?

These codes identify a lack of proper security controls. CWE-306 refers to 'Missing Authentication for Critical Function,' meaning the system fails to verify who is making a request. CWE-862 refers to 'Missing Authorization,' meaning it also fails to check if the user has permission to perform administrative tasks. Together, they allow someone to bypass login requirements entirely.

How can an attacker trigger this vulnerability?

An attacker can trigger this by sending direct HTTP requests to specific administrative script files located in the /admin/ directory of the application. The vulnerability is triggered automatically because the system does not check for a valid session token or administrative credentials; however, requests to non-administrative pages or scripts that require active session validation are not part of this specific flaw.

How do I know if my installation is at risk?

According to Halo Surface Signal, this software is often deployed as a web service, making it a target if its administrative interface is reachable over the network. If your instance is internet-facing, it is at higher risk of unauthorized access. You should evaluate whether your deployment is exposed to the public web or restricted to internal users.

What should I do if I use this software?

Your first step is to locate every instance of the software in your environment and determine its network accessibility and business importance. Once identified, work with your infrastructure or security teams to restrict access to the administrative directory and plan for remediation, such as applying vendor updates or implementing access controls to prevent unauthorized requests.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.