CVE-2025-59749: Andsoft E-tms XSS Vulnerability

CVE-2025-59749 Overview

CVE-2025-59749 is a reflected cross-site scripting (XSS) vulnerability affecting AndSoft's e-TMS v25.03, a transportation management system. The flaw resides in the l parameter of the /clt/TRACK_REQUEST.ASP endpoint, which fails to properly sanitize user-supplied input before reflecting it into the HTTP response. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when clicked. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, and unauthorized actions within the e-TMS application.

Affected Products

AndSoft e-TMS v25.03
Endpoint: /clt/TRACK_REQUEST.ASP
Vulnerable parameter: l

Discovery Timeline

2025-10-02 - CVE-2025-59749 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59749

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the TRACK_REQUEST.ASP script of AndSoft e-TMS v25.03. The application accepts a value through the l query parameter and writes it into the rendered HTML response without applying output encoding or contextual sanitization. An attacker who convinces a user to visit a crafted URL can execute JavaScript in the user's browser under the origin of the e-TMS deployment.

Because the injection point reflects directly into the HTML context, standard XSS payloads using <script> tags or event handler attributes (onerror, onload) can trigger execution. Successful exploitation compromises the confidentiality of the victim's session, and it can be chained with social engineering to target authenticated logistics operators.

Root Cause

The root cause is missing input validation and output encoding on the l parameter processed by /clt/TRACK_REQUEST.ASP. Classic Active Server Pages that emit user-controlled query values via Response.Write without applying Server.HTMLEncode produce this class of defect. The scope of impact per the CVSS v4.0 vector indicates confidentiality impact only, with no integrity or availability effect on the underlying system.

Attack Vector

Exploitation is remote and requires no authentication or prior privileges. The attacker delivers a crafted link, typically through phishing email, chat, or a malicious referrer, and relies on the victim clicking the URL while authenticated to the e-TMS instance. The malicious l value contains JavaScript that executes in the DOM context of the e-TMS domain.

The attack pattern follows a typical reflected XSS chain: the attacker builds a URL such as https://<host>/clt/TRACK_REQUEST.ASP?l=<injected_payload>, hosts or distributes the link, and the victim's browser evaluates the injected script against the e-TMS session cookies and DOM. No exploit code is publicly available in Exploit-DB, and the vulnerability is not listed in CISA KEV. See the INCIBE Security Notice for coordinated disclosure details.

Detection Methods for CVE-2025-59749

Indicators of Compromise

HTTP requests to /clt/TRACK_REQUEST.ASP containing suspicious values in the l parameter, including <script, javascript:, onerror=, or URL-encoded equivalents (%3Cscript).
Web server access logs showing referrers from external domains immediately followed by requests to TRACK_REQUEST.ASP with unusual query strings.
Browser console errors or CSP violation reports originating from the e-TMS application host.

Detection Strategies

Deploy web application firewall (WAF) rules that flag reflected XSS payload signatures in query parameters targeting ASP endpoints.
Correlate outbound requests from user browsers to attacker-controlled domains shortly after loading /clt/TRACK_REQUEST.ASP to identify data exfiltration attempts.
Review authentication logs for unusual session activity, such as concurrent logins or requests from unexpected geographies following user access to the vulnerable endpoint.

Monitoring Recommendations

Enable verbose logging on the IIS server hosting e-TMS and forward logs to a centralized SIEM for query-parameter inspection.
Alert on any inbound URL to TRACK_REQUEST.ASP containing HTML meta-characters (<, >, ", ') or JavaScript keywords in the l parameter.
Monitor phishing intelligence feeds for URLs referencing the customer's e-TMS hostname and the TRACK_REQUEST.ASP path.

How to Mitigate CVE-2025-59749

Immediate Actions Required

Contact AndSoft to obtain a patched build of e-TMS that addresses the reflected XSS in /clt/TRACK_REQUEST.ASP.
Deploy WAF signatures that block XSS payloads targeting the l parameter until a vendor fix is applied.
Inform users, particularly logistics operators and dispatchers, about phishing links referencing the e-TMS application.

Patch Information

AndSoft has not published a fixed version reference within the NVD entry at the time of publication. Refer to the INCIBE Security Notice for coordinated update guidance and contact AndSoft support to confirm the availability of a security release addressing v25.03.

Workarounds

Configure a reverse proxy or WAF to reject requests to /clt/TRACK_REQUEST.ASP where the l parameter contains HTML tags, angle brackets, or JavaScript scheme identifiers.
Enforce a strict Content Security Policy (CSP) on the e-TMS application that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on session cookies to limit the impact of successful JavaScript execution on stored credentials.

bash

# Example WAF rule (ModSecurity) to block XSS payloads on the vulnerable parameter
SecRule REQUEST_URI "@beginsWith /clt/TRACK_REQUEST.ASP" \
  "chain,phase:2,deny,status:403,id:1005974901,\
  msg:'CVE-2025-59749 reflected XSS attempt on l parameter'"
  SecRule ARGS:l "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "t:none,t:urlDecodeUni"