CVE-2025-25614 PoC — Unifiedtransform 访问控制错误漏洞

Source

https://github.com/armaansidana2003/CVE-2025-25614

Associated Vulnerability

Title: Unifiedtransform 访问控制错误漏洞 (CVE-2025-25614)
Description:Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.

Readme

# CVE-2025-25614

Incorrect Access Control in Unifiedtransform v2.X leads to Privilege Escalation, allowing teachers to update the personal data of fellow teachers.  

Vendor: [Unifiedtransform](https://github.com/changeweb/Unifiedtransform)  

---

## PoC

**Step 1:** Log in to the application as a Teacher.  

**Step 2:** Browse to the following endpoint:  
`/teachers/edit/3`

**Step 3:** Change the details and click on save.  

**Impact:** This allows unauthorized modifications to other teachers' data, which should only be accessible by administrators. This can lead to significant data integrity issues and unauthorized privilege escalation.  

---

**Vulnerability Type:** Incorrect Access Control  
**Attack Type:** Remote  
**Impact:** Escalation of Privileges  
**Attack Vectors:** Broken Access Control allows teachers to modify data of fellow teachers.  

**Discoverer:** Armaan Sidana  

**References:**  
- [Unifiedtransform Official Site](http://unifiedtransform.com)  
- [Unifiedtransform GitHub Repository](https://github.com/changeweb/Unifiedtransform)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →