CVE-2025-25614 PoC — Unifiedtransform 访问控制错误漏洞

介绍

# CVE-2025-25614

Incorrect Access Control in Unifiedtransform v2.X leads to Privilege Escalation, allowing teachers to update the personal data of fellow teachers.  

Vendor: [Unifiedtransform](https://github.com/changeweb/Unifiedtransform)  

---

## PoC

**Step 1:** Log in to the application as a Teacher.  

**Step 2:** Browse to the following endpoint:  
`/teachers/edit/3`

**Step 3:** Change the details and click on save.  

**Impact:** This allows unauthorized modifications to other teachers' data, which should only be accessible by administrators. This can lead to significant data integrity issues and unauthorized privilege escalation.  

---

**Vulnerability Type:** Incorrect Access Control  
**Attack Type:** Remote  
**Impact:** Escalation of Privileges  
**Attack Vectors:** Broken Access Control allows teachers to modify data of fellow teachers.  

**Discoverer:** Armaan Sidana  

**References:**  
- [Unifiedtransform Official Site](http://unifiedtransform.com)  
- [Unifiedtransform GitHub Repository](https://github.com/changeweb/Unifiedtransform)  

文件快照

备注