spbavarva/cve-2025-46203PoC of CVE-2025-46203
Unifiedtransform v2.0 is vulnerable to Incorrect Access Control. Any user (students and teachers) can access and modify student records via the /students/edit/{id} endpoints. This functionality intended exclusively for administrative use. Exploiting this vulnerability can lead to unauthorized data manipulation and privilege escalation.
Vendor: Unifiedtransform
A school management Software v2.0
Total Access Control Mechanism which is responsible for enforcing user permissions and roles. Route: GET /students/edit/{id} Controller: UserController Method: editStudents()
And all other endpoints and functionalities related to editing student profiles.
Step 1: Install the application as instructed in the official GitHub repository, and log in using the default admin credentials. ([email protected]:password)
Step 2: Create a school session and add both teachers and students as per the instructions provided in the repository.
Step 3: Log in to the application as a Teacher or Student.
Step 4: Navigate to the endpoint:
/students/edit/{id}
ID=1 is reserved for the Admin. IDs 2, 3, etc., are assigned to Teachers. IDs following those (e.g., 4, 5, ...) are assigned to Students. (For example, if you create 2 teachers and 2 students, then ID=2 will be Teacher 1, ID=3 will be Teacher 2, ID=4 will be Student 1, and ID=5 will be Student 2.)
Step 5: Change the details and click on update.
Vulnerability Type: Incorrect Access Control
Attack Type: Remote
Impact: Escalation of Privileges
Attack Vectors: Broken Access Control allows teachers or students to modify data of other students.
Discoverer: Sneh Bavarva
Impact: This allows unauthorized modifications to other student's data, which should only be accessible by administrators. This can lead to significant data integrity issues and unauthorized privilege escalation.
References:
https://github.com/changeweb/Unifiedtransform https://cwe.mitre.org/data/definitions/284.html
