Executive brief
Aptsys gemscms and gemsloyalty, which are backend platforms used for Point of Sale (POS) and loyalty programs, contain a vulnerability that exposes sensitive internal system information. By sending specifically crafted requests to the system, an unauthorized person can view technical details such as file paths, code snippets, and server error logs. This information does not directly grant access to customer data but provides a roadmap that attackers can use to plan more sophisticated attacks against the business.
Technical details
The PHP backend for Aptsys gemscms and gemsloyalty platforms fails to properly suppress verbose error reporting on public API endpoints. An unauthenticated remote attacker can trigger unhandled exceptions by sending malformed HTTP GET or POST requests. These exceptions result in the generation of error messages containing sensitive information, including internal server file paths, stack traces, and fragments of PHP code (CWE-209). This information disclosure aids in reconnaissance for further exploitation, such as identifying specific software versions or vulnerable code patterns. As of the advisory date, the vendor has not acknowledged the issue or provided a patch.
Affected products
- Aptsys gemscms backend thru 2025-05-28
- Aptsys gemsloyalty backend thru 2025-05-28
Timeline
- 2025-05-28: disclosed: Vulnerability discovered during normal application usage.
- 2026-01-23: advisory: CVE published to NVD.