CVE-2025-25621 PoC — Unifiedtransform 安全漏洞

介绍

# CVE-2025-25621

Unifiedtransform v2.X is vulnerable to Incorrect Access Control, allowing teachers to take attendance of fellow teachers through the endpoint `/courses/teacher/index?teacher_id=2&semester_id=1`.  

Vendor: [Unifiedtransform](https://github.com/changeweb/Unifiedtransform)  

---

## PoC

**Step 1:** Log in to the application as a Teacher.  

**Step 2:** Navigate to the endpoint `/courses/teacher/index?teacher_id=2&semester_id=1` (Change the Teacher ID).  

**Step 3:** Click on "Take Attendance" and then click on "Save."  

**Impact:** Teachers can manipulate attendance records for other teachers, which should only be possible for admins, leading to privilege escalation and potential misuse.  

---

**Vulnerability Type:** Incorrect Access Control  
**Attack Type:** Remote  
**Impact:** Privilege Escalation  
**Attack Vectors:** Broken access control, allowing teachers to take attendance for other teachers.  

**Discoverer:** Armaan Sidana  

**References:**  
- [Unifiedtransform Official Site](http://unifiedtransform.com)  
- [Unifiedtransform GitHub Repository](https://github.com/changeweb/Unifiedtransform)  

文件快照

备注