CVE-2025-52025

Critical · CVSS 9.4

Aptsys gemscms POS Platform — SQL Injection (CWE-89)

CVSS: 9.4; nvd
EPSS: —
KEV: No
Class: other; CWE-89

Description

An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitization or parameterization. This allows an attacker to inject and execute arbitrary SQL code by submitting crafted input in the id parameter, leading to unauthorized data access or modification.

Search profile — drives PoC discovery

Symbols GetServiceByRestaurantIDidgemscmsdynamic SQL query

Keywords CVE-2025-52025gemscmsAptsysPOS PlatformSQL InjectionGetServiceByRestaurantIDid parameterSQLigemscms backend

Versions: thru 2025-05-28

References

https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z