CVE-2025-59746: Andsoft E-tms XSS Vulnerability

CVE-2025-59746 Overview

CVE-2025-59746 is a reflected cross-site scripting (XSS) vulnerability affecting AndSoft's e-TMS transportation management platform, version 25.03. The flaw resides in the m parameter of the /lib/asp/alert.asp endpoint, where user-supplied input is reflected into the response without proper sanitization. An attacker can craft a malicious URL that, when opened by an authenticated user, executes arbitrary JavaScript in the victim's browser context. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, and unauthorized actions within the e-TMS application.

Affected Products

AndSoft e-TMS version 25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03
Component: andsoft:e-tms

Discovery Timeline

2025-10-02 - CVE-2025-59746 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59746

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the e-TMS web application. The /lib/asp/alert.asp script accepts a query parameter named m and writes its value back into the HTTP response without applying output encoding or input validation. When a browser renders the response, any JavaScript payload embedded in the m parameter executes in the origin of the e-TMS application.

Because the injection point sits inside an authenticated web interface used by logistics and transport operators, successful exploitation gives an attacker access to session cookies, CSRF tokens, and any data the victim can view. Attackers can also pivot to perform actions on behalf of the victim, such as modifying shipment records or accessing customer data.

Root Cause

The root cause is missing output encoding on the m request parameter in alert.asp. Classic ASP applications require developers to explicitly HTML-encode reflected values using Server.HTMLEncode. In this endpoint, the parameter is echoed directly into the HTML body, allowing <script> tags and event handlers to break out of the intended context.

Attack Vector

Exploitation requires an attacker to deliver a crafted URL to an authenticated e-TMS user through phishing, chat, or a malicious referrer. When the victim clicks the link, the injected script runs under the e-TMS domain. The attack requires no privileges on the target application and no local access. See the INCIBE Security Notice for coordinated disclosure details.

No verified public proof-of-concept code is available. The vulnerability pattern follows a standard reflected XSS payload delivered via the m query string parameter to /lib/asp/alert.asp.

Detection Methods for CVE-2025-59746

Indicators of Compromise

HTTP requests to /lib/asp/alert.asp containing URL-encoded <script>, onerror=, onload=, or javascript: tokens in the m parameter
Outbound browser connections from e-TMS user sessions to unknown external domains immediately after visiting the application
Unexpected Set-Cookie reads or session token exfiltration events tied to the e-TMS origin

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the m parameter on /lib/asp/alert.asp for HTML and JavaScript metacharacters
Enable IIS request logging with query string capture and alert on suspicious payload patterns matching XSS signatures
Correlate proxy and endpoint telemetry to identify users who clicked crafted e-TMS URLs originating from external referrers

Monitoring Recommendations

Baseline normal query parameter values for /lib/asp/alert.asp and flag anomalous lengths or non-alphanumeric characters
Monitor browser telemetry for script execution within the e-TMS origin that references external hosts
Review authentication logs for session anomalies such as concurrent logins from different IP addresses following URL clicks

How to Mitigate CVE-2025-59746

Immediate Actions Required

Apply the vendor update referenced in the INCIBE Security Notice as soon as AndSoft publishes a fixed release
Restrict access to the e-TMS web interface to trusted networks and VPN users while a patch is pending
Train users to avoid clicking unsolicited links referencing the e-TMS application, particularly URLs targeting /lib/asp/alert.asp

Patch Information

AndSoft has not published a fixed version identifier in the NVD record at the time of writing. Users of e-TMS v25.03 should contact AndSoft directly and reference the INCIBE coordinated disclosure to obtain remediation guidance and confirm patch availability.

Workarounds

Deploy WAF or reverse proxy rules that reject requests to /lib/asp/alert.asp when the m parameter contains HTML tags, angle brackets, or JavaScript event handlers
Enforce a strict Content Security Policy (CSP) on the e-TMS application to block inline script execution and untrusted script sources
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on the affected endpoint
SecRule REQUEST_URI "@beginsWith /lib/asp/alert.asp" \
    "chain,deny,status:403,id:1005974,msg:'CVE-2025-59746 XSS attempt on m parameter'"
    SecRule ARGS:m "@rx (?i)(<script|onerror=|onload=|javascript:|<img|<svg)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"