CVE-2025-59754: Andsoft E-tms XSS Vulnerability

CVE-2025-59754 Overview

CVE-2025-59754 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transportation management system version 25.03. The flaw resides in the /clt/LOGINFRM_original.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input before reflecting it in the HTTP response. An attacker can craft a malicious URL that, when opened by an authenticated or unauthenticated victim, executes arbitrary JavaScript in the victim's browser under the origin of the e-TMS application. The issue is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions within the e-TMS application.

Affected Products

AndSoft e-TMS version 25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03:*:*:*:*:*:*:*
Vulnerable endpoint: /clt/LOGINFRM_original.ASP

Discovery Timeline

2025-10-02 - CVE-2025-59754 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59754

Vulnerability Analysis

The vulnerability is a classic reflected XSS in the login page of AndSoft's e-TMS transportation management platform. The LOGINFRM_original.ASP script accepts several query-string parameters, including l, demo, demo2, TNTLOGIN, UO, and SuppConn, and echoes their values back into the HTML response without proper output encoding or input filtering.

Because the injected payload executes within the browser context of the e-TMS domain, an attacker can access any DOM content, cookies not protected by the HttpOnly flag, and perform authenticated requests on behalf of the victim. e-TMS is used to manage freight, dispatch, and logistics data, so a compromised session can expose customer records, shipment information, and back-office credentials.

Reflected XSS requires user interaction, typically clicking a crafted link delivered via phishing email, chat, or a malicious third-party site. Refer to the INCIBE Advisory on Multiple Vulnerabilities for the full technical write-up.

Root Cause

The root cause is missing server-side input validation and output encoding in the ASP handler that renders /clt/LOGINFRM_original.ASP. Parameter values are written directly into the HTML response stream, allowing an attacker to break out of the intended context and inject <script> tags or event-handler attributes.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL such as https://<target>/clt/LOGINFRM_original.ASP?l=<payload> where <payload> contains JavaScript. The victim is lured into clicking the link, and the payload executes in their browser against the e-TMS origin.

No authentication is required to trigger the reflection because the endpoint is a login form reachable by anonymous users. This lowers the barrier for phishing campaigns targeting e-TMS operators.

Detection Methods for CVE-2025-59754

Indicators of Compromise

Web server access logs containing requests to /clt/LOGINFRM_original.ASP with URL-encoded HTML or JavaScript syntax in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Requests referencing tokens such as %3Cscript, onerror=, onload=, javascript:, or document.cookie in query strings.
Unexpected external Referer headers on requests to the login form originating from unfamiliar domains or email-tracking services.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects query parameters on /clt/LOGINFRM_original.ASP for HTML metacharacters and known XSS payload patterns.
Correlate outbound traffic from browsers immediately following visits to the login page to identify data exfiltration from injected scripts.
Enable full HTTP request logging on the e-TMS web server and forward logs to a centralized platform for pattern matching against XSS signatures.

Monitoring Recommendations

Alert on spikes in 200-response requests to LOGINFRM_original.ASP that carry long or encoded query strings.
Monitor endpoint browsers for unusual DOM interactions, credential submissions to non-e-TMS hosts, and outbound requests to newly registered domains.
Track user reports of unexpected redirects, pop-ups, or session terminations while accessing the e-TMS portal.

How to Mitigate CVE-2025-59754

Immediate Actions Required

Contact AndSoft to obtain a fixed release or hotfix for e-TMS v25.03 and apply it across all environments.
Restrict external access to /clt/LOGINFRM_original.ASP at the network or WAF layer until patches are deployed.
Instruct users to avoid clicking e-TMS login links received via email or messaging platforms and to navigate to the portal directly.

Patch Information

At time of writing, no vendor advisory URL is listed in the NVD entry. Consult the INCIBE Advisory on Multiple Vulnerabilities and contact AndSoft support directly to confirm patch availability for version 25.03.

Workarounds

Deploy WAF rules that block or sanitize <, >, ", ', and javascript: sequences in the affected parameters on /clt/LOGINFRM_original.ASP.
Enforce a strict Content-Security-Policy response header disallowing inline scripts and restricting script sources to the e-TMS origin.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful XSS execution.
If the LOGINFRM_original.ASP file is a legacy artifact, remove it from the web root and redirect requests to the supported login page.

bash

# Example ModSecurity rule blocking XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_original.ASP" \
    "phase:2,deny,status:403,id:1005975,\
    msg:'CVE-2025-59754 reflected XSS attempt',\
    chain"
    SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
        "@rx (?i)(<script|onerror=|onload=|javascript:|document\.cookie)"