This vulnerability involves the PHP backend of gemsloyalty.aptsys.com.sg allowing unauthenticated attackers to cause the system to reveal detailed error messages. By sending crafted HTTP GET or POST requests to public API endpoints, attackers can obtain internal file paths, code snippets, and stack traces. Such information disclosure can aid attackers in further exploitation attempts. The issue is classified as CWE-209, indicating information exposure through error messages. There is no indication of known exploits in the wild or available patches.

The vulnerability leads to information disclosure of internal server details such as file paths, code snippets, and stack traces. While it does not directly affect integrity or availability, the leaked information can assist attackers in crafting more effective attacks against the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing error handling configurations that suppress detailed error messages from being returned to unauthenticated users. Restricting access to API endpoints or employing web application firewalls to detect and block suspicious requests may reduce exposure.