Vulnerability Description
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Aptsys | Gemscms Backend | <= 2025-05-28 |
Related Weaknesses (CWE)
References
- http://aptsys.comProduct
- https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39Third Party Advisory
FAQ
What is CVE-2025-52024?
CVE-2025-52024 is a vulnerability with a CVSS score of 9.4 (CRITICAL). A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is pre...
How severe is CVE-2025-52024?
CVE-2025-52024 has been rated CRITICAL with a CVSS base score of 9.4/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-52024?
Check the references section above for vendor advisories and patch information. Affected products include: Aptsys Gemscms Backend.