CVE-2025-59751: AndSoft E-tms XSS Vulnerability

CVE-2025-59751 Overview

CVE-2025-59751 is a reflected cross-site scripting (XSS) vulnerability affecting AndSoft's e-TMS version 25.03. The flaw resides in the /clt/LOGINFRM_DJO.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to properly sanitize user-supplied input. Attackers can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser context. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions within the e-TMS transportation management application.

Affected Products

AndSoft e-TMS v25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03:*:*:*:*:*:*:*
Component: andsoft:e-tms

Discovery Timeline

2025-10-02 - CVE-2025-59751 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59751

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the login form handler of AndSoft's e-TMS transportation management platform. The /clt/LOGINFRM_DJO.ASP script accepts multiple query parameters (l, demo, demo2, TNTLOGIN, UO, and SuppConn) and reflects their values into the HTTP response without adequate output encoding.

An attacker delivers a crafted URL to a victim via phishing email, chat message, or a compromised third-party site. When the victim loads the URL, injected JavaScript executes with the privileges of the current e-TMS session. Because e-TMS handles logistics and supply chain data, exploitation can expose shipment records, customer information, and administrative controls.

The EPSS score of 0.181% indicates a low probability of near-term exploitation, but reflected XSS remains a common initial-access technique for credential harvesting and session takeover.

Root Cause

The root cause is missing input validation and output encoding in the ASP handler for LOGINFRM_DJO.ASP. Parameters are inserted into the rendered HTML response without HTML-entity encoding or contextual escaping. Any string containing <script> tags or event-handler attributes reaches the browser intact and is parsed as executable code.

Attack Vector

The attack requires user interaction. An attacker constructs a URL such as https://<target>/clt/LOGINFRM_DJO.ASP?l=<payload> where <payload> contains JavaScript. The victim clicks the link while authenticated, and the payload runs in the victim's browser under the e-TMS origin.

The vulnerability is network-accessible and requires no attacker privileges. Refer to the INCIBE Advisory on Vulnerabilities for additional technical context. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2025-59751

Indicators of Compromise

HTTP requests to /clt/LOGINFRM_DJO.ASP containing <script>, javascript:, onerror=, or onload= substrings in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
URL-encoded XSS payloads such as %3Cscript%3E or %22%3E%3Cimg in referer headers or web-server access logs.
Anomalous outbound requests from user browsers to attacker-controlled hosts shortly after visiting e-TMS URLs.

Detection Strategies

Deploy a Web Application Firewall (WAF) with rules matching common XSS payload patterns targeting the affected endpoint and parameters.
Enable verbose access logging on the e-TMS web server and review logs for suspicious query strings containing HTML or JavaScript syntax.
Correlate authentication events with subsequent unusual API activity that may indicate session hijacking following an XSS payload execution.

Monitoring Recommendations

Alert on any request to /clt/LOGINFRM_DJO.ASP whose parameters exceed expected length or contain angle brackets, quotes, or the javascript: scheme.
Monitor browser Content Security Policy (CSP) violation reports for blocked inline script executions on e-TMS pages.
Track user-agent and geolocation anomalies for sessions established immediately after clicks on external referrers.

How to Mitigate CVE-2025-59751

Immediate Actions Required

Contact AndSoft to obtain the patched release of e-TMS and schedule an upgrade from v25.03.
Restrict access to /clt/LOGINFRM_DJO.ASP at the network or reverse-proxy layer until a fix is applied.
Deploy a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources on e-TMS pages.
Educate users to avoid clicking unsolicited links referencing the e-TMS application.

Patch Information

Refer to the INCIBE Advisory on Vulnerabilities for vendor remediation guidance. No specific patched version identifier is listed in the NVD record at the time of publication. Contact AndSoft directly to confirm the fixed build.

Workarounds

Configure the reverse proxy or WAF to reject requests to /clt/LOGINFRM_DJO.ASP containing angle brackets, quotes, or JavaScript keywords in the affected parameters.
Enforce HttpOnly and Secure flags on all session cookies to limit the impact of JavaScript execution against session tokens.
Add X-XSS-Protection: 1; mode=block and a restrictive Content-Security-Policy header at the web-server or proxy layer.

bash

# Example NGINX reverse-proxy hardening for e-TMS
location /clt/LOGINFRM_DJO.ASP {
    if ($args ~* "(<|>|script|javascript:|onerror=|onload=)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://etms_backend;
}