PT-2026-4527 · Aptsys · Gems Loyalty Php Backend

Published 2026-01-23 · Updated 2026-02-11 · CVE-2025-52022

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gems Loyalty PHP Backend versions through 2025-05-28

Description A flaw exists in the PHP backend of gemsloyalty.aptsys.com.sg that permits unauthenticated remote attackers to initiate detailed error messages. These messages reveal internal file paths, code snippets, and stack traces. The issue is triggered by specifically designed HTTP GET/POST requests sent to public API endpoints, potentially exposing sensitive information that could aid in further attacks. This is categorized as information exposure through an error message.

Recommendations Apply fixes to address the issue in Gems Loyalty PHP Backend versions through 2025-05-28.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2025-52022

Affected Products

Gems Loyalty Php Backend

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-52022 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52022 · Vendor Advisory
• https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39 · Note
• https://t.me/cveNotify/151745 · Telegram Post
• https://twitter.com/CVEnew/status/2015362487038955580 · Twitter Post
• https://t.me/CVEtracker/42881 · Telegram Post
• http://aptsys.com · Note
• https://twitter.com/VulmonFeeds/status/2014840062203035852 · Twitter Post