armaansidana2003/cve-2025-25620Proof-of-concept for stored XSS in Unifiedtransform v2.0's Create Assignment function, demonstrating remote code execution via malicious PDF upload and account takeover.
Unifiedtransform v2.0 is vulnerable to Stored Cross-Site Scripting (XSS) in the "Create Assignment" function, allowing attackers to execute malicious scripts in the context of other users' sessions.
Vendor: Unifiedtransform
Step 1: Log in to the application as a Teacher.
Step 2: Create an assignment and upload a PDF file containing an XSS payload.
Step 3: Navigate to the "View Assignment" section under Courses and open the uploaded assignment.
Impact: Malicious scripts execute when the assignment is viewed, potentially leading to Account Takeover (ATO) and other severe security implications.
Vulnerability Type: Cross-Site Scripting (XSS)
Attack Type: Remote
Impact: Code Execution
Attack Vectors: Stored XSS through assignment creation, triggered upon assignment view.
Discoverer: Armaan Sidana
References:
