CVE-2025-59743: Andsoft E-tms SQL Injection Vulnerability

CVE-2025-59743 Overview

CVE-2025-59743 is a critical SQL injection vulnerability discovered in AndSoft's e-TMS v25.03, a transportation management system. This vulnerability allows an unauthenticated attacker to manipulate database operations by sending specially crafted POST requests. The vulnerable parameter is the SessionID cookie within the /inc/connect/CONNECTION.ASP endpoint, enabling complete database compromise including data retrieval, creation, modification, and deletion.

Critical Impact

Unauthenticated attackers can achieve full database access via SQL injection, potentially compromising sensitive transportation and logistics data, customer information, and operational records.

Affected Products

• AndSoft e-TMS v25.03
• Prior versions of AndSoft e-TMS may also be affected

Discovery Timeline

• 2025-10-02 - CVE-2025-59743 published to NVD
• 2025-10-02 - Last updated in NVD database

Technical Details for CVE-2025-59743

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in AndSoft's e-TMS transportation management system. The flaw resides in the CONNECTION.ASP file located at /inc/connect/, which processes session authentication. The application fails to properly sanitize user-supplied input within the SessionID cookie before incorporating it into SQL queries executed against the backend database.

The vulnerability is classified as network-exploitable with no authentication required, meaning any attacker with network access to the e-TMS application can leverage this flaw. Successful exploitation grants attackers the ability to perform complete CRUD (Create, Read, Update, Delete) operations on the underlying database, potentially exposing sensitive business data, customer records, and operational logistics information.

Root Cause

The root cause stems from improper input validation and lack of parameterized queries in the CONNECTION.ASP file. The application directly concatenates the SessionID cookie value into SQL statements without proper sanitization or the use of prepared statements. This classic SQL injection pattern allows attackers to inject arbitrary SQL syntax that gets executed with the privileges of the database user configured for the e-TMS application.

Attack Vector

The attack is executed remotely over the network by sending a malicious POST request to the /inc/connect/CONNECTION.ASP endpoint. The attacker injects SQL payload through the SessionID cookie header. Since no authentication is required and the attack can be performed without user interaction, it represents a significant risk to any internet-exposed e-TMS installation.

An attacker would craft a POST request with a maliciously constructed SessionID cookie containing SQL injection payloads. Depending on the database backend, techniques such as UNION-based injection, blind SQL injection, or time-based injection could be employed to extract data, modify records, or escalate privileges within the database system. The lack of authentication requirements means automated scanning and exploitation is trivial. For technical details, see the INCIBE Security Notice.

Detection Methods for CVE-2025-59743

Indicators of Compromise

• Unusual POST requests to /inc/connect/CONNECTION.ASP containing SQL syntax in cookie headers
• Anomalous SessionID cookie values with SQL keywords such as UNION, SELECT, INSERT, UPDATE, DELETE, or comment sequences (--, /*)
• Database query logs showing unauthorized or malformed queries originating from the e-TMS application
• Unexpected database modifications, new user accounts, or data exfiltration patterns

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in cookie headers
• Implement application-layer monitoring to flag requests to CONNECTION.ASP with suspicious cookie values
• Enable detailed database audit logging to capture and alert on anomalous query patterns
• Configure SIEM rules to correlate web server logs with database activity for potential injection attempts

Monitoring Recommendations

• Monitor HTTP traffic for POST requests to /inc/connect/CONNECTION.ASP with abnormal SessionID cookie lengths or special characters
• Implement real-time alerting on database errors or exceptions that may indicate SQL injection attempts
• Review access logs for repeated requests from single IP addresses targeting the vulnerable endpoint
• Enable SentinelOne's Singularity XDR to detect post-exploitation behaviors such as data exfiltration or lateral movement

How to Mitigate CVE-2025-59743

Immediate Actions Required

• Restrict network access to the e-TMS application to trusted IP ranges only using firewall rules
• Place a Web Application Firewall (WAF) in front of the e-TMS deployment with SQL injection detection rules enabled
• Monitor database activity for signs of exploitation while awaiting vendor patch
• Review database access logs for any historical evidence of compromise

Patch Information

Contact AndSoft directly for security patches addressing CVE-2025-59743. Review the INCIBE Security Notice for the latest update information and vendor communication channels. Apply the official security patch as soon as it becomes available from the vendor.

Workarounds

• Implement input validation at the network edge using WAF or reverse proxy to strip or block suspicious cookie values
• Restrict access to the /inc/connect/ directory to only essential internal systems
• Configure the database user account used by e-TMS with minimal required privileges to limit potential damage
• Consider taking the e-TMS application offline or restricting access to internal networks only until patched

# Example WAF rule to block SQL injection in cookies (ModSecurity syntax)
SecRule REQUEST_COOKIES "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in cookie',\
    tag:'attack-sqli'"