CVE-2024-0730 is a medium severity flaw in Project Worlds Online Time Table Generator 1.0, scored 6.3 by NVD. No fixed version is confirmed in the sources I could check, so limit who can reach it, watch for a vendor release, and plan an upgrade or replacement.
What's affected
The record lists Project Worlds Online Time Table Generator 1.0 as affected. The record says the id argument in course_ajax.php leads to SQL injection and that the attack can be initiated remotely. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The weakness is CWE-89.
The record's description is short and does not name a fixed release. The linked pages are public write-ups of the issue, not a vendor patch notice.
How to check if you're exposed
Look for the application on your web servers, using the project name or the course_ajax.php file. Check where it is deployed and whether it is reachable from the internet. Review access logs for odd values in the id parameter.
If the product reached you inside another package, run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether it appears. For standalone software, the inventory is the check: find where it is installed, which version it is, and whether the service is reachable from outside the machine.
What to do now
- Find every installation of the product and note its version.
- Check the vendor site and project repository for a newer release, and read its notes before upgrading. Do not assume a later version is fixed without a statement that says so.
- Restrict network access to the service with firewall rules so only trusted hosts can reach it.
- Watch logs for repeated odd requests or unexpected crashes aimed at the affected component.
- If the software looks unmaintained, plan to replace it, and record the risk decision in the meantime.
Why it matters
SQL injection happens when user supplied text is placed into a database query without being kept separate from the query structure. The record names the vulnerable parameter and file, and the CWE-89 tag confirms the class. The usual cure is prepared statements with bound parameters, plus least privilege database accounts so that a flaw exposes less.
The score is medium because the record rates impact as low across confidentiality, integrity and availability, and in some cases a login is required. That is a floor, not a ceiling: what an injection can read or change depends on the database account the application uses and the data behind it. Small PHP applications often connect as a powerful database user, which makes a flaw worth more than the score suggests.
This kind of project comes from a code sharing site for student and demonstration applications. Such code is rarely hardened for production, so running it on a public host is a risk on its own.
The record notes that an exploit has been disclosed publicly. That is not the same as confirmed attacks, and the record does not flag this CVE in the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort for someone to try it, which is a reason to reduce exposure early.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Should this run in production?
Applications of this type are usually written as demonstrations. Keep them off public hosts or replace them.
Is there a fix?
None is confirmed.
Sources
Last reviewed: 19 October 2026.
