CVE-2025-52025

Critical

Published: 23 January 2026

Published

23 January 2026

Modified

11 February 2026

KEV Added

—

Patch

—

CVSS Score 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS Score 0.0002 4.2th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-52025 is a critical-severity SQL Injection (CWE-89) vulnerability in Aptsys Gemscms Backend. Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the 'id' parameter before dynamic SQL query construction.

SI-2 Flaw Remediation good match

prevent

Mandates timely remediation of the specific SQL injection flaw in the GetServiceByRestaurantID endpoint through identification, patching, and testing.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

Enables vulnerability scanning to identify SQL injection flaws in the Aptsys gemscms POS backend, allowing proactive prioritization for remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing web endpoint directly enables remote exploitation (T1190) and arbitrary database queries for data access/modification (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitization or parameterization. This allows…

an attacker to inject and execute arbitrary SQL code by submitting crafted input in the id parameter, leading to unauthorized data access or modification.

Deeper analysisAI

CVE-2025-52025 is an SQL injection vulnerability in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend, affecting versions through 2025-05-28. The issue stems from user input in the 'id' parameter being directly inserted into dynamic SQL query syntax without sanitization or parameterization, enabling attackers to inject and execute arbitrary SQL code. This flaw is classified under CWE-89 and carries a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating high severity due to its potential for significant confidentiality and integrity impacts.

The vulnerability can be exploited remotely over the network by unauthenticated attackers with low complexity and no user interaction required. By submitting crafted input to the 'id' parameter, attackers can achieve unauthorized access to sensitive data, such as restaurant service details or broader database contents, as well as modify data within the database, potentially leading to data leakage, tampering, or further compromise of the POS system.

Advisories and additional details are referenced at http://aptsys.com and https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39, which may provide guidance on patches or mitigation strategies for affected deployments.