Unifiedtransform Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Unifiedtransform version 2.0. The issue arises from incorrect access control in the application, allowing remote attackers to escalate privileges through the '/course/edit/{id}' endpoint. This vulnerability enables unauthorized users, such as students and teachers, to modify course details, including names and categories, which could disrupt academic management and curriculum integrity.

Impact

Exploitation of this vulnerability allows unauthorized users to change course information, potentially leading to academic mismanagement.

Reproduction

To reproduce this vulnerability, log into the application as a teacher or student. Navigate to the '/course/edit/{id}' endpoint, replacing '{id}' with the ID of an existing course. Once there, modify the course name and type, then click 'update' to save the changes.