CVE-2025-59755: Andsoft E-tms XSS Vulnerability

CVE-2025-59755 Overview

CVE-2025-59755 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transportation management system, version 25.03. The flaw resides in the /clt/LOGINFRM_CAT.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters reflect unsanitized user input into the HTTP response. Attackers can craft a malicious URL that, when opened by an authenticated user, executes arbitrary JavaScript in the browser session. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions within the e-TMS application.

Affected Products

AndSoft e-TMS version 25.03
Web endpoint: /clt/LOGINFRM_CAT.ASP
Deployments exposing the login form to untrusted networks

Discovery Timeline

2025-10-02 - CVE-2025-59755 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59755

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the login form handler of AndSoft e-TMS v25.03. The /clt/LOGINFRM_CAT.ASP script accepts six user-controlled parameters (l, demo, demo2, TNTLOGIN, UO, SuppConn) and reflects their values into the HTML response without proper output encoding or input validation. An attacker who can convince a target to click a crafted link triggers JavaScript execution within the origin of the e-TMS application. Because e-TMS is a transportation management platform, successful exploitation can expose logistics data, session cookies, and administrative functionality. The Spanish national CERT (INCIBE) published a coordinated advisory covering this and other flaws in e-TMS.

Root Cause

The root cause is missing output encoding on request parameters processed by the classic ASP handler. Values passed via query string or form submission are echoed directly into HTML markup, allowing <script> tags and JavaScript event handlers to break out of the intended context. No Content Security Policy (CSP) header is enforced to mitigate script execution.

Attack Vector

Exploitation requires no authentication and no prior access. An attacker constructs a URL to /clt/LOGINFRM_CAT.ASP with a payload injected into one of the affected parameters, then delivers the link through phishing, chat, or a compromised third-party site. When a victim clicks the link, the injected script executes in the context of the e-TMS domain. The payload can exfiltrate session identifiers, submit forged requests, or render a fake login prompt to harvest credentials.

No verified exploitation code is publicly available. See the INCIBE Security Notice for coordinated disclosure details.

Detection Methods for CVE-2025-59755

Indicators of Compromise

Requests to /clt/LOGINFRM_CAT.ASP containing URL-encoded <script>, onerror=, onload=, or javascript: payloads in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters
Referer headers from untrusted external domains preceding suspicious requests to the login endpoint
Unexpected outbound requests from user browsers immediately after visiting the e-TMS login page

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect query strings for XSS payloads targeting the affected parameters
Enable HTTP request logging on the IIS server hosting e-TMS and search for anomalous parameter values against the login handler
Correlate browser telemetry with server-side access logs to identify script execution originating from the e-TMS origin

Monitoring Recommendations

Alert on user-agent, referer, and query-string anomalies for /clt/LOGINFRM_CAT.ASP
Monitor authentication events for session reuse from unexpected IP addresses following XSS-pattern requests
Track outbound HTTP requests from internal users to newly registered or low-reputation domains

How to Mitigate CVE-2025-59755

Immediate Actions Required

Contact AndSoft support to obtain the security update addressing the e-TMS v25.03 XSS vulnerabilities disclosed in the INCIBE advisory
Restrict access to /clt/LOGINFRM_CAT.ASP to trusted networks or VPN clients until a patched version is deployed
Enforce a strict Content Security Policy header on the e-TMS application to limit inline script execution

Patch Information

AndSoft has coordinated disclosure with INCIBE-CERT. Administrators should review the INCIBE Security Notice and request the corresponding fixed build from the vendor. No public patch commit or version number was included in the NVD record at the time of publication.

Workarounds

Deploy a WAF rule that blocks requests containing <, >, ", ', or script tokens in the affected parameters of /clt/LOGINFRM_CAT.ASP
Set the HttpOnly and Secure flags on all session cookies to reduce the impact of script-based session theft
Add X-XSS-Protection: 1; mode=block and Content-Security-Policy: default-src 'self' response headers at the reverse proxy
Train users to avoid clicking e-TMS links delivered via unsolicited email or chat

bash

# Example IIS URL Rewrite rule to block XSS payloads on the vulnerable endpoint
<rule name="Block-XSS-LOGINFRM_CAT" stopProcessing="true">
  <match url="^clt/LOGINFRM_CAT\.ASP$" />
  <conditions logicalGrouping="MatchAny">
    <add input="{QUERY_STRING}" pattern="(?i)(%3Cscript|onerror=|onload=|javascript:)" />
  </conditions>
  <action type="CustomResponse" statusCode="403" statusReason="Forbidden" />
</rule>