Improper Access Control in School Management System: Unifiedtransform

On 29 July 2024, the researchers at Astra identified a critical vulnerability in UnifiedTransform, a popular school management software. CVE-2024-53573 is an improper access control vulnerability in an admin endpoint, leading to an account takeover.

Improper Access Control vulnerabilities occur when an application fails to enforce proper function restrictions, leading to unintended exposure of sensitive information and actions.

How Do Improper Access Control Vulnerabilities Occur?

Insufficient Permission

The application does not enforce proper permission restrictions for lower-privilege users, allowing attackers to leverage the Broken Access Control and exploit the system’s lack of protection.

Privilege Escalation

Attackers can modify the URLs or other request parameters, leading to unauthorized access. For example:

• URL Manipulation: accessing the admin/restricted URLs directly without authorization
• Parameter Tampering: altering the URL parameters like session IDs or user IDs

Unauthorized Access

Once the attackers gain access, they can view sensitive data or perform unauthorized high-privilege actions like:

• altering user roles or permissions
• access confidential data
• alter system settings or flow

It is one small security loophole v/s your entire website or web application.

Get your web app audited with
Astra’s Continuous Pentest Solution.

Explore Features Schedule a meeting

Impact of Improper Access Control

Account Takeover

Unauthorized users can access user profiles and modify details like profile information, email addresses, or even passwords, potentially gaining control of the accounts.

Date Integrity Risks

• Data Tampering: Attackers can manipulate, modify, or delete sensitive data, affecting the integrity and overall functionality of the application.
• Malicious Actions: Attackers can alter system functions to cause unintended behavior, alter privileges, and compromise the application’s integrity and security.

Current Status

Upon discovering the vulnerability, the researchers promptly notified the platform’s developers. They provided possible solutions, such as enforcing strict access control policies, restricting endpoint access and recommended reviewing and securing all endpoints across the application.

What Can You Do?

Update the affected version to the latest version once released by the Unifiedtransform team.