armaansidana2003/cve-2025-25616Proof-of-concept demonstrating incorrect access control in Unifiedtransform v2.0, allowing students to modify exam rules via the /exams/edit-rule endpoint, leading to privilege escalation.
Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing students to modify exam rules. The affected endpoint is /exams/edit-rule?exam_rule_id=1.
Vendor: Unifiedtransform
Step 1: Log in to the application as a Student.
Step 2: Browse to the following endpoint:
/exams/edit-rule?exam_rule_id=1
(Modify the exam_rule_id parameter to target different exam rules.)
Step 3: Change the exam rules and click on save.
Impact: This allows unauthorized modification of exam rules, which should only be accessible by administrators. Students could manipulate exam parameters, like setting minimum passing marks, leading to severe business logic flaws and compromising the integrity of the exam system.
Vulnerability Type: Incorrect Access Control
Attack Type: Remote
Impact: Escalation of Privileges
Attack Vectors: Broken Access Control allows students to modify exam rules.
Discoverer: Armaan Sidana
References:
