This vulnerability in the Aptsys POS Platform Web Services module allows unauthenticated external users to access internal API testing tools through specific URLs. The exposed interface lists backend services and POS web services with interactive HTML forms for testing. Because these tools are accessible without authentication or session validation in production, attackers can interact with critical API endpoints that perform sensitive functions including user transaction retrieval, credit adjustments, POS actions, and internal data queries. The CVSS 3.1 base score is 9.4, reflecting high impact on confidentiality and integrity with low attack complexity and no required privileges or user interaction.

The vulnerability enables unauthenticated attackers to access and interact with internal API testing tools, potentially exposing sensitive data such as user transactions and allowing unauthorized credit adjustments and POS operations. This compromises confidentiality and integrity of the system with limited impact on availability. The lack of authentication or session validation in production environments significantly increases the risk of unauthorized data access and manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected URLs by implementing authentication and session validation controls, and remove or disable developer testing tools from production environments to prevent unauthorized access.