Executive Summary

This vulnerability is an information disclosure issue in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform. The endpoint is unauthenticated and returns a list of cashier accounts including sensitive information such as names, email addresses, usernames, and passwords hashed with MD5. Since MD5 is a weak cryptographic function, the password hashes can be easily reversed using public tools, exposing the plaintext passwords to attackers.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability to obtain plaintext credentials of cashier accounts by reversing the weak MD5 password hashes. This allows unauthorized logins, potentially giving attackers access to sensitive point-of-sale operations or backend functions, which could lead to data theft, fraud, or further compromise of the system.

Useful 0 Not Useful 0