CVE-2025-25615 PoC — Unifiedtransform 访问控制错误漏洞

介绍

# CVE-2025-25615

Unifiedtransform v2.X is vulnerable to Incorrect Access Control, allowing teachers to view the attendance list for all class sections.  

Vendor: [Unifiedtransform](https://github.com/changeweb/Unifiedtransform)  

---

## PoC

**Step 1:** Log in to the application as a Teacher.  

**Step 2:** Browse to the following endpoint:  
/attendances/view?class_id=1&section_id=2&course_id=1

(Modify the `class_id` and `section_id` parameters to access different sections.)

**Step 3:** View the attendance of any class section.  

**Impact:** This allows unauthorized access to attendance data across all sections, a feature that should be restricted to administrators only. This can lead to privacy violations and data misuse.  

---

**Vulnerability Type:** Incorrect Access Control  
**Attack Type:** Remote  
**Impact:** Escalation of Privileges  
**Attack Vectors:** Broken Access Control allows teachers to view attendance data for any class section.  

**Discoverer:** Armaan Sidana  

**References:**  
- [Unifiedtransform Official Site](http://unifiedtransform.com)  
- [Unifiedtransform GitHub Repository](https://github.com/changeweb/Unifiedtransform)  

文件快照

备注