armaansidana2003/cve-2025-25618Proof-of-concept demonstrating incorrect access control in Unifiedtransform v2.0, allowing teachers to modify section details. Includes step-by-step reproduction and impact analysis.
Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to change the Section Name and Room Number — permissions that should be restricted to administrators.
Vendor: Unifiedtransform
Step 1: Log in to the application as a Teacher.
Step 2: Browse to the following endpoint:
/section/edit/1
Step 3: Modify the Section Name and Room Number fields and click on save.
Impact: Unauthorized changes to section details can lead to mismanagement and confusion in academic operations. Teachers altering these critical details can disrupt class assignments, schedules, and classroom management, which should only be handled by administrators.
Vulnerability Type: Incorrect Access Control
Attack Type: Remote
Impact: Escalation of Privileges
Attack Vectors: Broken Access Control allows teachers to modify section names and room numbers without proper authorization.
Discoverer: Armaan Sidana
References:
