CVE-2025-3042 is a medium severity (CVSS 6.3) unrestricted file upload in Project Worlds Online Time Table Generator 1.0. The pic argument in /student/updateprofile.php is not checked properly. I could not confirm a fixed version, so restrict uploads and check with the project.
What's affected
The record lists Project Worlds Online Time Table Generator 1.0 as affected. The weak spot is /student/updateprofile.php, through the pic argument.
No fixed version appears in the record. The references are a VulDB entry and a researcher's report on GitHub, and neither is a vendor advisory. Assume there is no official patch until you find one.
This CVE has a sibling, CVE-2025-3041, in a different file of the same product. The record says the exploit was disclosed publicly and the attack can start remotely. It does not say the flaw is exploited in the wild, and it is not in the CISA KEV catalog.
How to check if you're exposed
Online Time Table Generator is a PHP application that you host yourself, so the check is on your server.
- Confirm whether it is deployed and whether it is version 1.0.
- Find where uploaded pictures are saved and list files with extensions that are not images.
- Review web server logs for POST requests to /student/updateprofile.php from addresses you do not know.
The file is under the student area, so ordinary student accounts may reach it. Check how accounts are created and who holds one.
What to do now
- Find every copy of this application and take public ones offline if they are not needed.
- Restrict the upload feature so that only image types are accepted, and rename files on save.
- Store uploads outside the web root, or make sure the server cannot execute anything in the upload folder.
- Limit network access to /student/updateprofile.php where you can, and review the user accounts that can use it.
- Look for a maintained alternative if you rely on this tool, since I found no fix.
Why it matters
The record maps the flaw to CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). A field meant for a profile picture accepts files that are not pictures, and the server keeps them somewhere it may run them.
If the server runs an uploaded script, the attacker gains control at the web server's privilege level, which can expose database credentials stored in the application's files. The medium score reflects the limits in the CVSS vector. Your own risk depends on whether the endpoint needs a login and what the web server account can access.
Teaching projects and sample applications are often put online without a review. If that is your case, treat the code as untrusted and review upload handling before exposing it.
Quick check
Is there a patch?
I could not confirm one. Check the project's own page, and do not assume a fix exists.
Why do picture uploads cause trouble?
Because the server may trust the file name or type sent by the browser. Checking content and storing the file safely closes the gap.
Sources
Last reviewed: 19 October 2026.
