来源

关联漏洞

介绍

# CVE-2025-25614

Incorrect Access Control in Unifiedtransform v2.X leads to Privilege Escalation, allowing teachers to update the personal data of fellow teachers.  

Vendor: [Unifiedtransform](https://github.com/changeweb/Unifiedtransform)  

---

## PoC

**Step 1:** Log in to the application as a Teacher.  

**Step 2:** Browse to the following endpoint:  
`/teachers/edit/3`

**Step 3:** Change the details and click on save.  

**Impact:** This allows unauthorized modifications to other teachers' data, which should only be accessible by administrators. This can lead to significant data integrity issues and unauthorized privilege escalation.  

---

**Vulnerability Type:** Incorrect Access Control  
**Attack Type:** Remote  
**Impact:** Escalation of Privileges  
**Attack Vectors:** Broken Access Control allows teachers to modify data of fellow teachers.  

**Discoverer:** Armaan Sidana  

**References:**  
- [Unifiedtransform Official Site](http://unifiedtransform.com)  
- [Unifiedtransform GitHub Repository](https://github.com/changeweb/Unifiedtransform)  

文件快照

 [4.0K]  /data/pocs/07898047b28db57b9b428a019e897529ad875f4d
└── [1.1K]  README.md

0 directories, 1 file

备注