CVE-2025-59747: Andsoft E-tms XSS Vulnerability

CVE-2025-59747 Overview

CVE-2025-59747 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transport management platform, version 25.03. The flaw resides in the l parameter of the /clt/resetPassword.asp endpoint, which fails to sanitize user-supplied input before reflecting it in the response. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session when clicked. The vulnerability is tracked under CWE-79 and was disclosed through Spain's INCIBE-CERT coordination process.

Critical Impact
Successful exploitation enables session hijacking, credential theft through fake login overlays, and unauthorized actions performed in the context of authenticated e-TMS users.

Affected Products

AndSoft e-TMS version 25.03
/clt/resetPassword.asp password reset endpoint
Deployments exposing the l URL parameter to untrusted input

Discovery Timeline

2025-10-02 - CVE-2025-59747 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59747

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the client-facing password reset page of e-TMS. The l query parameter, likely intended to carry a language or locale identifier, is echoed back into the HTML response without proper output encoding or input validation. An attacker who convinces a target to visit a specially crafted URL can inject arbitrary JavaScript that executes under the origin of the e-TMS application.

Because the attack targets the resetPassword.asp workflow, phishing lures referencing account recovery are especially effective. Once the payload executes, it inherits access to any cookies not marked HttpOnly, DOM content, and the ability to issue same-origin requests on behalf of the victim.

Root Cause

The root cause is missing contextual output encoding for the l parameter before it is reflected into the server-generated HTML. The application trusts the raw query string value and inserts it into the response body, allowing HTML and script syntax to break out of the intended text context. This is a classic Type-1 reflected XSS pattern classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires no authentication and no privileges. The attacker delivers a crafted link, typically via email, chat, or a compromised page, that includes a JavaScript payload in the l parameter of /clt/resetPassword.asp. When a victim opens the link in an authenticated browser session, the injected script runs in the e-TMS origin. Refer to the INCIBE Security Notice for the coordinated advisory details.

No public exploit code or proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-59747

Indicators of Compromise

HTTP GET requests to /clt/resetPassword.asp where the l parameter contains <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers pointing to external domains sending users into the resetPassword.asp flow.
Unusual outbound requests from client browsers to attacker-controlled domains immediately after loading the reset page.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings on /clt/* endpoints for XSS signatures, including HTML tag characters and JavaScript event handlers.
Enable server access log review focused on the l parameter length and character composition, alerting when non-alphanumeric input is observed.
Correlate reset-password page hits with subsequent authentication anomalies, such as session use from unexpected geolocations.

Monitoring Recommendations

Aggregate e-TMS web server logs into a centralized log platform and build detections for suspicious query strings on the affected endpoint.
Monitor Content Security Policy (CSP) violation reports if CSP is deployed, since injected scripts often trigger script-src violations.
Track help desk tickets for reports of unexpected page behavior on the password reset flow, which is a common early signal.

How to Mitigate CVE-2025-59747

Immediate Actions Required

Contact AndSoft support to confirm the fixed release addressing CVE-2025-59747 and schedule an upgrade from version 25.03.
Restrict access to /clt/resetPassword.asp behind a WAF policy that blocks HTML and script metacharacters in the l parameter.
Force re-authentication of active user sessions if suspicious access to the reset endpoint is observed.

Patch Information

AndSoft has coordinated the disclosure through INCIBE-CERT. Consult the INCIBE Security Notice for the current list of remediated e-TMS builds and apply the vendor-supplied update to all production and staging instances.

Workarounds

Deploy a WAF or reverse proxy rule that rejects requests to /clt/resetPassword.asp whose l parameter contains <, >, ", ', (, ), or %3C/%3E encodings.
Set the HttpOnly and Secure flags on session cookies to limit the impact of script execution.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins.

bash

# Example ModSecurity rule to block XSS payloads in the 'l' parameter
SecRule REQUEST_URI "@beginsWith /clt/resetPassword.asp" \
    "chain,phase:2,deny,status:403,id:1059747,\
    msg:'CVE-2025-59747 - Reflected XSS attempt on e-TMS resetPassword.asp'"
    SecRule ARGS:l "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
        "t:none,t:urlDecodeUni"