CVE-2025-59756: Andsoft E-tms XSS Vulnerability

CVE-2025-59756 Overview

CVE-2025-59756 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transport management platform, version 25.03. The flaw resides in the /clt/LOGINFRM_CON.ASP endpoint, where the SuppConn parameter and related parameters (l, demo, demo2, TNTLOGIN, UO) fail to sanitize user-supplied input before reflecting it in the HTTP response. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session when clicked. The issue is tracked as CWE-79 and was disclosed through Spain's national CERT, INCIBE.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated user's browser, enabling session theft, credential harvesting, and unauthorized actions in the e-TMS application.

Affected Products

AndSoft e-TMS version 25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03
The vulnerable endpoint is /clt/LOGINFRM_CON.ASP

Discovery Timeline

2025-10-02 - CVE-2025-59756 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database
Advisory - Coordinated disclosure published via INCIBE Security Notice

Technical Details for CVE-2025-59756

Vulnerability Analysis

The vulnerability is a classic reflected XSS flaw in an ASP-based login handler. The LOGINFRM_CON.ASP script receives multiple query string parameters and embeds their values directly into the returned HTML response without contextual output encoding. Because the injected content is reflected before any authentication check, an unauthenticated attacker can weaponize the endpoint. The victim only needs to visit an attacker-crafted URL for the payload to execute in the security context of the e-TMS origin.

Exploitation grants the attacker access to any data or functionality available in the victim's browser session. In a transport management system, this includes shipment records, customer identifiers, and potentially the credentials used to authenticate to the platform.

Root Cause

The root cause is missing input validation and output encoding on the SuppConn, l, demo, demo2, TNTLOGIN, and UO parameters in /clt/LOGINFRM_CON.ASP. The ASP handler treats parameter values as trusted HTML fragments when rendering the login form, allowing angle brackets, quotes, and script tags to pass through unmodified.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted URL through phishing email, chat, or a third-party site that redirects to the vulnerable endpoint. When the target loads the URL, the injected JavaScript executes within the e-TMS origin. The attack vector is network-based, requires no privileges, and depends on the victim clicking the link.

The vulnerability is described in prose because no verified proof-of-concept code has been published. Technical details are available in the INCIBE Security Notice.

Detection Methods for CVE-2025-59756

Indicators of Compromise

Web server access logs containing requests to /clt/LOGINFRM_CON.ASP with query parameters holding <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Unusual Referer headers pointing to attacker-controlled domains that redirect users to the e-TMS login page.
Outbound requests from user browsers to unknown domains immediately after visiting LOGINFRM_CON.ASP, suggesting data exfiltration by injected script.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to inspect the SuppConn, l, demo, demo2, TNTLOGIN, and UO parameters for HTML and JavaScript metacharacters.
Correlate reflected input in HTTP response bodies with unsanitized query values to identify successful injection attempts in real time.
Monitor endpoint browser telemetry for script execution originating from the e-TMS domain that references external hosts.

Monitoring Recommendations

Enable verbose IIS logging for the /clt/ path and forward logs to a SIEM for parameter-level analysis.
Alert on any request to LOGINFRM_CON.ASP whose query string length exceeds a defined baseline or contains encoded angle brackets.
Track user session anomalies, such as concurrent sessions from disparate IP addresses, that could indicate session hijacking through stolen cookies.

How to Mitigate CVE-2025-59756

Immediate Actions Required

Contact AndSoft to obtain the fixed release for e-TMS v25.03 and schedule deployment.
Restrict access to the e-TMS web interface to trusted networks or VPN clients until a patch is applied.
Instruct users to avoid clicking e-TMS links received from untrusted senders and to authenticate only through bookmarked URLs.

Patch Information

AndSoft has coordinated remediation through INCIBE. Refer to the INCIBE Security Notice for the current fixed version and vendor guidance. Apply the vendor-supplied update to all e-TMS installations running version 25.03.

Workarounds

Configure a WAF or reverse proxy to block requests to /clt/LOGINFRM_CON.ASP containing <, >, ", ', or script in the vulnerable parameters.
Set the HttpOnly and Secure flags on session cookies so injected scripts cannot read authentication tokens.
Enforce a strict Content Security Policy (CSP) on the e-TMS application to prevent inline script execution.

bash

# Example ModSecurity rule to block XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /clt/LOGINFRM_CON.ASP" \
    "chain,phase:2,deny,status:403,id:1005975,\
    msg:'CVE-2025-59756 XSS attempt on e-TMS LOGINFRM_CON.ASP'"
    SecRule ARGS:SuppConn|ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO \
        "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)"