CVE-2025-5003 is a high severity (CVSS 7.3) SQL injection flaw in projectworlds Online Time Table Generator 1.0. The ID argument handled by /semester_ajax.php reaches a database query unsafely, and the record says the exploit is public. No fixed version is confirmed, so treat the application as unpatched until the vendor says otherwise.
What's affected
projectworlds Online Time Table Generator version 1.0, per the record. The weak spot is the ID argument in /semester_ajax.php. The record describes the attack as remote, needing no special privileges beyond reaching the page, and says the exploit has been disclosed publicly.
The record does not list a fixed version or a vendor advisory. Its references are a researcher write-up and entries in the VulDB database. Check the vendor's download page for a newer release before you assume one exists.
projectworlds distributes small PHP project templates. These are typically meant for coursework and demos, but copies do end up on public servers, where nobody is watching for security notices.
How to check if you're exposed
Start by finding out whether you run this application at all. On a Linux web server, look for the vulnerable file by name under your web roots:
find /var/www -type f -name "semester_ajax.php" 2>/dev/null
Then confirm the product and version from the application's own pages or readme, and check whether the path is reachable from outside your network. Your web server access logs will show whether anything has requested that file:
grep "/semester_ajax.php" /var/log/apache2/access.log | tail -n 50
Adjust the log path for your server. Requests to this file with unusual values in ID are worth a closer look, but a clean log does not prove safety.
Only test applications you own or have permission to test.
What to do now
- Find every copy of projectworlds Online Time Table Generator in your environment, including test servers and old virtual machines.
- Check the vendor site for a fixed release. If none is listed, do not wait for one.
- Fix the code path: replace string joined queries with prepared statements that bind ID, and review other inputs in /semester_ajax.php the same way.
- Put the application behind authentication or a VPN if it does not need to be public, and consider a web application firewall rule as a temporary layer.
- Restrict the database account used by the app to the tables it needs.
- Review database contents and logs for changes you did not make, and rotate any credentials stored in the database.
Why it matters
The weakness is CWE-89 with its parent class CWE-74: user supplied input becomes part of a SQL command. The database cannot tell the query the developer wrote from the text the visitor added, so it runs both. Depending on the query, that can mean reading records, changing them, or in some setups worse.
Look at how the parameter reaches the database. In vulnerable code the value from the request is joined into the query text. The fix is to bind it as a parameter instead.
The flaw is not marked as exploited in the wild: the record's KEV flag is false. A public write-up still lowers the effort for anyone who finds your server, and small PHP applications are easy to find with internet scans.
Quick check
Is there a patch for CVE-2025-5003?
No fixed version is confirmed in the record. Check the vendor's site, and fix the query handling in /semester_ajax.php yourself if you must keep the application running.
Does this need a login to exploit?
The record's CVSS vector shows no privileges required and no user interaction, and describes the attack as remote. Treat the page as reachable by anyone who can connect to the server.
Sources
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It will not find a standalone PHP application copied onto a server, but it helps for the libraries in projects you do manage.
Last reviewed: 18 October 2026.
