# CVE-2025-25621
Unifiedtransform v2.X is vulnerable to Incorrect Access Control, allowing teachers to take attendance of fellow teachers through the endpoint `/courses/teacher/index?teacher_id=2&semester_id=1`.
Vendor: [Unifiedtransform](https://github.com/changeweb/Unifiedtransform)
---
## PoC
**Step 1:** Log in to the application as a Teacher.
**Step 2:** Navigate to the endpoint `/courses/teacher/index?teacher_id=2&semester_id=1` (Change the Teacher ID).
**Step 3:** Click on "Take Attendance" and then click on "Save."
**Impact:** Teachers can manipulate attendance records for other teachers, which should only be possible for admins, leading to privilege escalation and potential misuse.
---
**Vulnerability Type:** Incorrect Access Control
**Attack Type:** Remote
**Impact:** Privilege Escalation
**Attack Vectors:** Broken access control, allowing teachers to take attendance for other teachers.
**Discoverer:** Armaan Sidana
**References:**
- [Unifiedtransform Official Site](http://unifiedtransform.com)
- [Unifiedtransform GitHub Repository](https://github.com/changeweb/Unifiedtransform)
[4.0K] /data/pocs/237855e36bbe21a2836ce01bfdb6ef78fcccd186
└── [1.1K] README.md
0 directories, 1 file