FKIE_CVE-2025-52024

Vulnerability from fkie_nvd - Published: 2026-01-23 21:15 - Updated: 2026-02-11 19:23
Severity ?
9.4 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Summary
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries.
References
cve@mitre.orghttp://aptsys.comProduct
cve@mitre.orghttps://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39Third Party Advisory
Impacted products
Vendor Product Version
aptsys gemscms_backend *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:aptsys:gemscms_backend:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F83E13A-9AF7-4E42-9849-9D9684967078",
              "versionEndIncluding": "2025-05-28",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad existe en el m\u00f3dulo de servicios web de la plataforma Aptsys POS hasta el 28-05-2025, lo que expone herramientas internas de prueba de API a usuarios no autenticados. Al acceder a URL espec\u00edficas, a un atacante se le presenta un \u00edndice estilo directorio que lista todos los servicios backend y servicios web POS disponibles, cada uno con un formulario HTML para enviar entradas de prueba. Estos paneles est\u00e1n destinados para uso de desarrolladores, pero son accesibles en entornos de producci\u00f3n sin autenticaci\u00f3n ni validaci\u00f3n de sesi\u00f3n. Esto otorga a cualquier actor externo la capacidad de descubrir, probar y ejecutar endpoints de API que realizan funciones cr\u00edticas, incluyendo, entre otros, recuperaci\u00f3n de transacciones de usuario, ajustes de cr\u00e9dito, acciones de POS y consultas de datos internas."
    }
  ],
  "id": "CVE-2025-52024",
  "lastModified": "2026-02-11T19:23:51.853",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.5,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-23T21:15:50.610",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "http://aptsys.com"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-425"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.