CVE-2025-59750: Andsoft E-tms XSS Vulnerability

CVE-2025-59750 Overview

CVE-2025-59750 is a reflected Cross-Site Scripting (XSS) vulnerability affecting AndSoft's e-TMS transportation management system version 25.03. The flaw resides in the /clt/LOGINFRM.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters accept unsanitized user input. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when clicked. The vulnerability is tracked under CWE-79 and requires user interaction to trigger.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and phishing attacks against authenticated e-TMS users through crafted URLs delivered via email or messaging platforms.

Affected Products

AndSoft e-TMS v25.03
/clt/LOGINFRM.ASP login endpoint
Deployments exposing the affected parameters to untrusted network input

Discovery Timeline

2025-10-02 - CVE-2025-59750 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59750

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the e-TMS login form handler. The affected ASP page reflects the values of six query-string parameters back into the HTML response without adequate output encoding or input validation. When a victim visits a malicious URL, the attacker-controlled payload executes in the context of the e-TMS application origin.

Reflected XSS in a login page carries elevated risk because attackers can inject scripts that capture credentials before authentication occurs. The INCIBE Security Notice confirms multiple vulnerabilities affecting the same product family. The current EPSS probability indicates a low likelihood of exploitation in the near term, but public disclosure increases the risk profile.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The LOGINFRM.ASP handler concatenates parameter values into HTML output without applying context-appropriate encoding. Any input passed via l, demo, demo2, TNTLOGIN, UO, or SuppConn is rendered directly, allowing script tags and event handlers to execute.

Attack Vector

Exploitation requires a network-based delivery mechanism and user interaction. An attacker constructs a URL targeting /clt/LOGINFRM.ASP with a JavaScript payload embedded in one of the vulnerable parameters. The attacker delivers the URL through phishing email, chat messages, or malicious links on external sites. When the victim clicks the link, the injected script executes in their browser session, enabling cookie theft, credential harvesting via fake login overlays, or forced actions against the e-TMS application.

The vulnerability manifests when the ASP handler reflects raw parameter data into the HTML response. See the INCIBE advisory for the full list of affected parameters and vendor guidance.

Detection Methods for CVE-2025-59750

Indicators of Compromise

HTTP requests to /clt/LOGINFRM.ASP containing script tags, javascript: schemes, or HTML event handlers in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters
URL-encoded payloads such as %3Cscript%3E, %3Cimg, or onerror= in query strings targeting the login page
Referrer headers originating from external domains that point users to the e-TMS login endpoint with unusual query parameters

Detection Strategies

Deploy web application firewall rules that inspect query parameters on /clt/LOGINFRM.ASP for HTML and JavaScript metacharacters
Review web server access logs for requests containing suspicious payloads in the six named parameters
Correlate outbound user clicks to the e-TMS login page against email gateway telemetry to identify phishing lures

Monitoring Recommendations

Enable verbose logging on the e-TMS web server and forward logs to a centralized analytics platform for query-string inspection
Alert on anomalous spikes in traffic to LOGINFRM.ASP with encoded characters in query parameters
Monitor endpoint browser telemetry for script execution originating from the e-TMS domain that deviates from baseline application behavior

How to Mitigate CVE-2025-59750

Immediate Actions Required

Contact AndSoft for a security update addressing the parameter handling in /clt/LOGINFRM.ASP
Deploy a web application firewall rule to block HTML and JavaScript metacharacters in the affected parameters
Instruct users to avoid clicking untrusted links pointing to the e-TMS login page and to report suspicious URLs

Patch Information

No vendor patch URL is listed in the NVD entry at the time of publication. Review the INCIBE Security Notice for vendor communications and available updates. Contact AndSoft support directly to confirm the availability of a fixed release for e-TMS v25.03.

Workarounds

Implement a reverse proxy filter that rejects requests to /clt/LOGINFRM.ASP containing <, >, ", ', or javascript: sequences in query parameters
Set the Content-Security-Policy response header to restrict inline script execution on the e-TMS application
Enable the HttpOnly and Secure flags on session cookies to reduce the impact of successful script injection
Restrict access to the e-TMS login endpoint using IP allow-listing or VPN gating where operationally feasible

bash

# Example nginx rule to block script metacharacters on the affected endpoint
location /clt/LOGINFRM.ASP {
    if ($args ~* "(<|>|script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://etms-backend;
}