CVE-2025-52025
Published: 23 January 2026
Summary
CVE-2025-52025 is a critical-severity SQL Injection (CWE-89) vulnerability in Aptsys Gemscms Backend. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-52025 is an SQL injection vulnerability in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend, affecting versions through 2025-05-28. The issue stems from user input in the 'id' parameter being directly inserted into dynamic SQL query syntax without sanitization or parameterization, enabling attackers to inject and execute arbitrary SQL code. This flaw is classified under CWE-89 and carries a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating high severity due to its potential for significant confidentiality and integrity impacts.
The vulnerability can be exploited remotely over the network by unauthenticated attackers with low complexity and no user interaction required. By submitting crafted input to the 'id' parameter, attackers can achieve unauthorized access to sensitive data, such as restaurant service details or broader database contents, as well as modify data within the database, potentially leading to data leakage, tampering, or further compromise of the POS system.
Advisories and additional details are referenced at http://aptsys.com and https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39, which may provide guidance on patches or mitigation strategies for affected deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4242
Vulnerability details
An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitization or parameterization. This allows…
more
an attacker to inject and execute arbitrary SQL code by submitting crafted input in the id parameter, leading to unauthorized data access or modification.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web endpoint directly enables remote exploitation (T1190) and arbitrary database queries for data access/modification (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of untrusted inputs like the 'id' parameter before dynamic SQL query construction.
Mandates timely remediation of the specific SQL injection flaw in the GetServiceByRestaurantID endpoint through identification, patching, and testing.
Enables vulnerability scanning to identify SQL injection flaws in the Aptsys gemscms POS backend, allowing proactive prioritization for remediation.