armaansidana2003/cve-2025-25615Proof-of-concept demonstrating incorrect access control in Unifiedtransform v2.0, allowing teachers to view attendance for any class section via crafted parameters.
Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to view the attendance list for all class sections.
Vendor: Unifiedtransform
Step 1: Log in to the application as a Teacher.
Step 2: Browse to the following endpoint:
/attendances/view?class_id=1§ion_id=2&course_id=1
(Modify the class_id and section_id parameters to access different sections.)
Step 3: View the attendance of any class section.
Impact: This allows unauthorized access to attendance data across all sections, a feature that should be restricted to administrators only. This can lead to privacy violations and data misuse.
Vulnerability Type: Incorrect Access Control
Attack Type: Remote
Impact: Escalation of Privileges
Attack Vectors: Broken Access Control allows teachers to view attendance data for any class section.
Discoverer: Armaan Sidana
References:
