CVE-2025-59753: Andsoft E-tms XSS Vulnerability

CVE-2025-59753 Overview

CVE-2025-59753 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transportation management platform version 25.03. The flaw resides in the /clt/LOGINFRM_BET.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters reflect user-supplied input without proper sanitization. Attackers can craft malicious URLs that execute arbitrary JavaScript in the victim's browser once the target interacts with the link. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can hijack authenticated sessions, steal cookies, or redirect users to malicious infrastructure by tricking them into clicking crafted URLs targeting the e-TMS login page.

Affected Products

AndSoft e-TMS version 25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03
Vulnerable endpoint: /clt/LOGINFRM_BET.ASP

Discovery Timeline

2025-10-02 - CVE-2025-59753 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59753

Vulnerability Analysis

The vulnerability affects the client-side login form component of AndSoft's e-TMS, a transportation management system used by logistics operators. The /clt/LOGINFRM_BET.ASP script accepts six user-controlled parameters (l, demo, demo2, TNTLOGIN, UO, and SuppConn) and reflects their values back into the rendered HTML response. Because the application fails to encode or filter these values, an attacker can inject arbitrary JavaScript that executes within the trust context of the e-TMS domain.

Exploitation requires user interaction, since the victim must click a crafted URL. Once triggered, injected scripts run with the same privileges as the victim's browser session. This enables session cookie theft, keystroke logging on the login form, credential harvesting via forged UI elements, and pivoting to internal logistics workflows.

Root Cause

The root cause is missing output encoding on parameters processed by the ASP page. User-supplied query string values are concatenated directly into HTML output without applying context-aware escaping. Any script tags, event handlers, or JavaScript URI schemes supplied in the affected parameters render as executable content in the response.

Attack Vector

The attack is delivered over the network and requires no authentication. An attacker constructs a URL such as https://<victim-etms>/clt/LOGINFRM_BET.ASP?l=<payload> where <payload> contains an XSS vector. The attacker then distributes the URL through phishing emails, chat platforms, or malicious advertising. When a logistics operator or partner clicks the link, the injected script executes in their browser session against the e-TMS origin.

No verified public proof-of-concept code is available. Refer to the INCIBE CERT Notice: Multiple Vulnerabilities for the coordinated disclosure details.

Detection Methods for CVE-2025-59753

Indicators of Compromise

HTTP GET requests to /clt/LOGINFRM_BET.ASP containing URL-encoded <script>, onerror=, onload=, or javascript: substrings in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters
Unusually long query string values on the LOGINFRM_BET.ASP endpoint from external referrers
Referrer headers pointing to unfamiliar domains preceding requests against the e-TMS login page

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters on /clt/LOGINFRM_BET.ASP for HTML tags and JavaScript event handlers
Enable verbose IIS logging for the e-TMS application and alert on parameter values exceeding expected length or containing angle brackets
Correlate login page requests with subsequent anomalous authenticated actions from the same session identifier

Monitoring Recommendations

Forward IIS and reverse proxy logs to a centralized logging platform and build detections for XSS payload signatures targeting the affected parameters
Monitor outbound browser telemetry from workstations that access e-TMS for connections to unexpected external domains following login page visits
Track user reports of unexpected authentication prompts or redirects originating from e-TMS URLs

How to Mitigate CVE-2025-59753

Immediate Actions Required

Contact AndSoft to obtain the patched release addressing the reflected XSS in /clt/LOGINFRM_BET.ASP
Restrict access to the e-TMS application to trusted networks or VPN users until a fix is applied
Review the INCIBE CERT advisory for the complete list of related vulnerabilities disclosed against e-TMS

Patch Information

No vendor patch URL is listed in the NVD entry at the time of publication. Organizations running e-TMS v25.03 should contact AndSoft support directly and reference CVE-2025-59753 along with the INCIBE CERT coordinated disclosure. Upgrade to a fixed release once available.

Workarounds

Deploy a WAF rule that blocks requests to /clt/LOGINFRM_BET.ASP containing HTML metacharacters (<, >, ", ') or JavaScript event handler substrings in the affected parameters
Enforce a strict Content-Security-Policy header on the e-TMS application to disallow inline script execution and unauthorized script sources
Set the HttpOnly and Secure flags on session cookies to limit exposure if a payload executes
Train users to avoid clicking e-TMS URLs received from untrusted sources and to access the platform via bookmarked URLs

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_BET.ASP" \
  "phase:2,chain,deny,status:403,id:1005973,\
   msg:'CVE-2025-59753 XSS attempt on e-TMS login form'"
  SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
    "@rx (?i)(<script|onerror=|onload=|javascript:|<img|<svg)"