Unifiedtransform Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Unifiedtransform version 2.0. It allows remote attackers to manipulate student records through the '/students/edit/{id}' endpoint. This endpoint is intended for administrative use only, and the vulnerability could lead to unauthorized data changes and privilege escalation.

Impact

Exploitation of this vulnerability allows unauthorized users (students and teachers) to modify student data, potentially leading to significant data integrity issues and unauthorized privilege escalation.

Reproduction

To reproduce this vulnerability, log into the application as a Teacher or Student. Navigate to the '/students/edit/{id}' endpoint, replacing '{id}' with the ID of a student. Modify the student details and submit the changes. The update will be processed, demonstrating the lack of proper access control.