Executive brief
Aptsys gemscms, a backend platform used for Point of Sale (POS) operations, contains a security flaw that exposes sensitive staff information. An unprotected web interface allows anyone on the internet to download a list of cashier accounts, including their names, email addresses, and passwords. Because the passwords are stored using an obsolete and weak security method, attackers can easily convert them back into plain text to gain unauthorized access to the POS system and business operations.
Technical details
An information disclosure vulnerability exists in the Aptsys gemscms backend platform due to an unauthenticated API endpoint at /srvs/membersrv/getCashiers. A remote, unauthenticated attacker can access this endpoint to retrieve a list of cashier account details, including usernames, email addresses, and password hashes. The passwords are hashed using the MD5 algorithm (CWE-327), which is cryptographically broken and susceptible to rapid collision or preimage attacks using public tools. Successful exploitation allows an attacker to recover plaintext credentials and perform unauthorized logins to sensitive POS or backend functions. As of the latest advisory, the vendor has not acknowledged the issue and no patch is available.
Affected products
- Aptsys gemscms backend thru 2025-05-28
Timeline
- 2025-05-28: disclosed: Vulnerability discovered and initial vendor notification attempted.
- 2026-01-23: advisory: CVE published to NVD.