CVE-2025-59743: Andsoft E-tms SQL Injection Vulnerability

CVE-2025-59743 Overview

CVE-2025-59743 is a SQL injection vulnerability [CWE-89] affecting AndSoft's e-TMS v25.03, a transportation management system. The flaw resides in the /inc/connect/CONNECTION.ASP endpoint, where the SessionID cookie value is concatenated into a SQL query without proper sanitization. Attackers can submit a crafted POST request to retrieve, create, update, or delete database records. Exploitation requires no authentication and no user interaction, making the issue reachable directly over the network. The Spanish National Cybersecurity Institute (INCIBE) published a coordinated security notice covering this and related e-TMS issues.

Critical Impact
Unauthenticated attackers can read or modify the underlying database of e-TMS v25.03, exposing logistics, customer, and operational data to full compromise.

Affected Products

AndSoft e-TMS v25.03
Deployments using /inc/connect/CONNECTION.ASP with SessionID cookie handling
Downstream integrations relying on the e-TMS backend database

Discovery Timeline

2025-10-02 - CVE-2025-59743 published to the National Vulnerability Database
2025-10-02 - Last updated in NVD database

Technical Details for CVE-2025-59743

Vulnerability Analysis

The vulnerability is a classic SQL injection issue in a web-facing ASP endpoint. The CONNECTION.ASP script reads the SessionID cookie from incoming POST requests and inserts the value into a SQL statement that is executed against the backing database. Because the cookie value is not parameterized or escaped, an attacker controls part of the query structure.

An attacker can therefore alter the query to perform UNION-based extraction, blind boolean inference, or stacked statements depending on the database engine. The result is full read and write access to the database, including the ability to create or drop objects. No credentials are required because the cookie is consumed before any authenticated session check binds it to a user.

The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is the direct concatenation of an attacker-controlled cookie value into a SQL query string. The application treats SessionID as a trusted identifier rather than untrusted input. Parameterized queries, prepared statements, and input validation are absent on this code path.

Attack Vector

The attack vector is remote and network-based. An attacker sends a POST request to /inc/connect/CONNECTION.ASP with a malicious SessionID cookie value. The injected SQL fragment executes with the privileges of the database account used by the e-TMS application. Refer to the INCIBE Security Notice for vendor-coordinated technical context.

Detection Methods for CVE-2025-59743

Indicators of Compromise

POST requests to /inc/connect/CONNECTION.ASP containing SQL syntax such as UNION, SELECT, --, ;, or WAITFOR DELAY inside the SessionID cookie.
Unusually long or URL-encoded SessionID cookie values from external IP addresses.
Database errors, unexpected schema changes, or new database accounts appearing without administrative action.

Detection Strategies

Inspect web server and IIS logs for anomalous Cookie: SessionID= header values targeting the CONNECTION.ASP path.
Enable database auditing on the e-TMS schema to capture DDL statements and bulk data reads.
Deploy a web application firewall rule that blocks SQL metacharacters in the SessionID cookie.

Monitoring Recommendations

Forward IIS, application, and database logs to a centralized SIEM for correlation across the request and query layers.
Alert on spikes in 500-series responses or query execution time from CONNECTION.ASP.
Track outbound data volume from the database server to detect mass exfiltration attempts.

How to Mitigate CVE-2025-59743

Immediate Actions Required

Restrict network exposure of e-TMS v25.03 to trusted networks or VPN until a vendor patch is applied.
Contact AndSoft support to obtain a fixed build and confirm the status of /inc/connect/CONNECTION.ASP.
Rotate database credentials used by the e-TMS application and review database accounts for unauthorized additions.

Patch Information

AndSoft has not published a public patch advisory at the time of writing. Coordinated disclosure information is available through the INCIBE Security Notice. Customers should request the remediated build directly from the vendor and validate that affected endpoints use parameterized queries.

Workarounds

Deploy a WAF signature that rejects POST requests to /inc/connect/CONNECTION.ASP where the SessionID cookie contains SQL syntax or non-hex characters.
Enforce a strict allow-list pattern (for example, alphanumeric only, fixed length) for the SessionID cookie at a reverse proxy.
Apply least-privilege permissions to the database account used by e-TMS so that DDL and cross-database operations are denied.

bash

# Example ModSecurity rule to block SQLi patterns in the SessionID cookie
SecRule REQUEST_COOKIES:SessionID "@rx (?i)(union\s+select|--|;|/\*|waitfor\s+delay|xp_cmdshell)" \
    "id:1059743,phase:1,deny,status:403,log,\
     msg:'CVE-2025-59743 e-TMS SessionID SQLi attempt'"