armaansidana2003/cve-2025-25621
Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to take attendance of fellow teachers through the endpoint /courses/teacher/index?teacher_id=2&semester_id=1.
Vendor: Unifiedtransform
Step 1: Log in to the application as a Teacher.
Step 2: Navigate to the endpoint /courses/teacher/index?teacher_id=2&semester_id=1 (Change the Teacher ID).
Step 3: Click on "Take Attendance" and then click on "Save."
Impact: Teachers can manipulate attendance records for other teachers, which should only be possible for admins, leading to privilege escalation and potential misuse.
Vulnerability Type: Incorrect Access Control
Attack Type: Remote
Impact: Privilege Escalation
Attack Vectors: Broken access control, allowing teachers to take attendance for other teachers.
Discoverer: Armaan Sidana
References:
