CVE-2025-52022
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-02-11
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aptsys | gemscms_backend | to 2025-05-28 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-209 | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Information Disclosure issue in the PHP backend of the Aptsys gemsloyalty platform. It occurs because detailed PHP error messages are shown to unauthenticated remote attackers when they send specially crafted HTTP GET or POST requests to public API endpoints. These error messages reveal sensitive internal information such as server file paths, code snippets, stack traces, framework details, variable names, and partial source code. This exposure happens due to unhandled exceptions returning full diagnostic output, which can help attackers understand the system better and plan further attacks. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by exposing sensitive internal information about the backend system to unauthenticated attackers. This information disclosure increases the attack surface, making it easier for attackers to identify weaknesses, craft more effective attacks, and potentially compromise the system further. It can lead to unauthorized access, data breaches, or other security incidents if exploited. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending specially crafted HTTP GET or POST requests to the public API endpoints of the gemsloyalty backend and observing if detailed PHP error messages are returned. These error messages disclose internal file paths, code snippets, stack traces, and other sensitive information. While specific commands are not provided, using tools like curl or HTTP clients to send malformed requests and inspecting the responses for verbose error output can help detect the issue. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling debug and verbose error output in production environments, implementing proper input validation to prevent unhandled exceptions, and using centralized sanitized error handling to avoid leaking sensitive backend information through error messages. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes sensitive internal information such as file paths, code snippets, and stack traces to unauthenticated remote attackers, which could lead to unauthorized access or further exploitation. Such information disclosure can increase the risk of data breaches or unauthorized data access, potentially impacting compliance with standards like GDPR or HIPAA that require protection of sensitive data and secure system configurations. Therefore, this vulnerability may negatively affect compliance by increasing the risk of data exposure and failing to maintain secure error handling practices. [1]