Unifiedtransform Stored Cross-Site Scripting Vulnerability in Assignment Creation

A stored cross-site scripting vulnerability has been identified in Unifiedtransform version 2.0. This issue arises in the 'Create Assignment' function, where an attacker can upload a PDF file containing an XSS payload. When the assignment is viewed, the malicious script executes, potentially leading to account takeover and other serious security consequences.

Impact

Exploitation of this vulnerability allows for the execution of malicious scripts in the context of other users' sessions, with the possibility of taking over their accounts.

Reproduction

To reproduce this vulnerability, log into the application as a teacher. Create an assignment and upload a PDF file that includes an XSS payload. After the assignment is uploaded, navigate to the 'View Assignment' section under Courses and open the uploaded assignment. The XSS payload will execute when the assignment is viewed.