This vulnerability (CVE-2025-52025) affects the Aptsys gemscms POS Platform backend in the GetServiceByRestaurantID endpoint. It arises from improper handling of user input in the id parameter, which is directly inserted into a dynamic SQL query without sanitization or parameterization. This SQL Injection flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands, potentially compromising sensitive data and modifying database contents. The CVSS v3.1 score is 9.4 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. There is no information about affected versions or available patches.

Successful exploitation can lead to unauthorized disclosure of sensitive data and unauthorized modification of database contents. The vulnerability has a critical impact on confidentiality and integrity, with limited impact on availability. It can be exploited remotely without authentication or user interaction, increasing the risk of widespread compromise of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable endpoint to untrusted networks or implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the id parameter. Review and apply secure coding practices such as input validation and parameterized queries when possible.