A critical authentication bypass vulnerability in ProjectWorlds Online Time Table Generator allows unauthenticated attackers to exfiltrate sensitive data, including plaintext passwords.

The application fails to perform necessary authentication checks on the /admin/student.php and /admin/teacher.php endpoints. This allows an unauthenticated attacker to retrieve sensitive information directly through HTTP GET requests.

The exposure of sensitive information, specifically plaintext passwords, represents a severe security risk that can lead to total account takeover and unauthorized access to administrative functions. With a CVSS score of 7.5, this vulnerability is considered High, as it allows attackers to compromise user accounts and potentially pivot further into the underlying database or server environment.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory or disable the affected files until a secure update is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting /admin/student.php and /admin/teacher.php from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthenticated access to the identified administrative endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's write-up referenced in the CVE record.

Given the ease of exploitation and the sensitive nature of the exposed data, immediate restriction of access to the vulnerable endpoints is required. Security teams should prioritize the implementation of access controls or WAF rules to mitigate this risk until the vendor releases a formal security patch.