CVE-2025-59752: Andsoft E-tms XSS Vulnerability

CVE-2025-59752 Overview

CVE-2025-59752 is a reflected cross-site scripting (XSS) vulnerability affecting AndSoft's e-TMS transportation management system, version 25.03. The flaw resides in the /clt/LOGINFRM_LXA.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input. An attacker can craft a malicious URL that, when opened by a victim, executes arbitrary JavaScript in the victim's browser session. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute JavaScript in a victim's browser through a crafted URL, enabling session theft, credential harvesting, or client-side redirection against e-TMS users.

Affected Products

AndSoft e-TMS v25.03
Web module /clt/LOGINFRM_LXA.ASP
Deployments exposing the affected login form to untrusted networks

Discovery Timeline

2025-10-02 - CVE-2025-59752 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59752

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the AndSoft e-TMS login interface. The affected script /clt/LOGINFRM_LXA.ASP echoes the values of six query parameters (l, demo, demo2, TNTLOGIN, UO, SuppConn) into the HTML response without proper output encoding. When a victim clicks a specially crafted link, the injected payload executes in the security context of the e-TMS application origin.

Because e-TMS is a transportation management platform handling logistics data, an attacker with script execution in the victim's session can access authenticated resources, exfiltrate session cookies, or trigger actions on behalf of the user. Refer to the INCIBE Security Notice for the full advisory.

Root Cause

The root cause is missing input sanitization and output encoding in the ASP-based login form handler. User-supplied query string values are reflected directly into the HTML response, allowing HTML and JavaScript syntax to break out of the intended attribute or element context.

Attack Vector

Exploitation requires network access to the e-TMS application and user interaction. An attacker delivers a crafted URL containing an XSS payload in one of the vulnerable parameters through phishing, chat, or a compromised referrer. When the victim opens the URL, the payload executes in their browser under the e-TMS origin. No authentication is required to trigger the reflection.

No verified public proof-of-concept code is available. See the INCIBE Security Notice for parameter details.

Detection Methods for CVE-2025-59752

Indicators of Compromise

HTTP requests to /clt/LOGINFRM_LXA.ASP containing <script>, javascript:, onerror=, or URL-encoded equivalents in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters
Referrers pointing to external domains that link into the affected login endpoint with unusually long query strings
Browser console errors or unexpected outbound requests originating from the e-TMS login page

Detection Strategies

Deploy WAF rules that inspect query strings on /clt/LOGINFRM_LXA.ASP for HTML tags, event handlers, and script schemes
Correlate web server access logs with authentication anomalies such as session reuse from a new IP shortly after a suspicious login URL visit
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts

Monitoring Recommendations

Alert on repeated 200 responses to /clt/LOGINFRM_LXA.ASP with query parameters exceeding typical length
Monitor for phishing campaigns delivering URLs pointing to internal e-TMS hostnames
Review outbound proxy logs for suspicious data exfiltration originating from browsers immediately after visiting the login page

How to Mitigate CVE-2025-59752

Immediate Actions Required

Restrict network exposure of /clt/LOGINFRM_LXA.ASP to trusted IP ranges or VPN users where feasible
Deploy a WAF signature blocking script tags and event handlers in the affected parameters
Contact AndSoft to obtain a fixed build of e-TMS beyond version 25.03

Patch Information

No vendor patch reference is listed in the NVD entry at time of publication. Administrators should consult AndSoft support and monitor the INCIBE Security Notice for updated remediation guidance covering this and related e-TMS vulnerabilities.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on e-TMS pages
Set the HttpOnly and Secure flags on session cookies to limit impact of script execution
Train users to avoid clicking untrusted links referencing the e-TMS login page and to authenticate only from bookmarked URLs

bash

# Example WAF rule (ModSecurity) blocking XSS payloads in vulnerable parameters
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_LXA.ASP" \
    "chain,phase:2,deny,status:403,id:1005952,msg:'CVE-2025-59752 XSS attempt'"
    SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
        "@rx (?i)(<script|javascript:|onerror=|onload=|<img|%3Cscript)" \
        "t:none,t:urlDecodeUni"