CVE-2025-59757: Andsoft E-tms XSS Vulnerability

CVE-2025-59757 Overview

CVE-2025-59757 is a reflected cross-site scripting (XSS) vulnerability affecting AndSoft's e-TMS transport management system, version 25.03. The flaw resides in the /clt/LOGINFRM_CATOLD.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters reflect user-supplied input without proper sanitization. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes arbitrary JavaScript in the victim's browser context. The vulnerability is tracked under CWE-79 and requires user interaction to succeed.

Critical Impact
Successful exploitation enables session hijacking, credential theft through injected phishing forms, and unauthorized actions performed on behalf of the victim within the e-TMS application.

Affected Products

AndSoft e-TMS v25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03:*:*:*:*:*:*:*
Deployments exposing /clt/LOGINFRM_CATOLD.ASP to untrusted networks

Discovery Timeline

2025-10-02 - CVE-2025-59757 published to NVD
2026-06-17 - Last updated in NVD database
Coordinated disclosure published via INCIBE Security Notice

Technical Details for CVE-2025-59757

Vulnerability Analysis

The vulnerability is a classic reflected XSS flaw in a legacy ASP page. The LOGINFRM_CATOLD.ASP script accepts values from six query-string parameters and writes them back into the HTML response without contextual output encoding. Because the reflected data is placed into an HTML or JavaScript context, attacker-controlled payloads break out of the intended data boundary and execute as script. The attack is network-reachable, requires no authentication, and is triggered when a targeted user clicks a crafted link. Executed script inherits the origin of the e-TMS application, granting access to session cookies, DOM contents, and any credentials submitted through the login form.

Root Cause

The root cause is missing input validation and output encoding on the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters. The ASP handler concatenates request values directly into the rendered page rather than applying HTML entity encoding or a context-aware sanitizer. No Content Security Policy (CSP) restricts inline script execution, which further enables payload delivery.

Attack Vector

An attacker crafts a URL such as https://<target>/clt/LOGINFRM_CATOLD.ASP?l=<payload> where <payload> contains a script tag or JavaScript event handler. The attacker distributes the link through phishing email, chat, or a compromised third-party site. When the victim opens the link, the injected payload executes in the browser under the e-TMS domain, allowing cookie exfiltration, credential harvesting via injected form fields, or forced actions against the transport management workflow.

No verified public exploit code has been released. See the INCIBE Security Notice for coordinated disclosure details.

Detection Methods for CVE-2025-59757

Indicators of Compromise

HTTP requests to /clt/LOGINFRM_CATOLD.ASP containing URL-encoded <script>, onerror=, onload=, or javascript: substrings in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Outbound requests from user browsers to unfamiliar domains immediately after visiting the e-TMS login page, indicating cookie or token exfiltration.
Referer headers pointing to external domains for requests hitting LOGINFRM_CATOLD.ASP.

Detection Strategies

Deploy web application firewall (WAF) rules that flag script metacharacters (<, >, ", ', =) inside the six vulnerable parameters.
Enable verbose IIS or reverse-proxy logging for the /clt/ path and hunt for encoded payloads such as %3Cscript%3E or %22onerror%3D.
Correlate email gateway telemetry for inbound URLs pointing to e-TMS hostnames with suspicious query strings.

Monitoring Recommendations

Ingest web server access logs into a centralized analytics platform and alert on anomalous query-string lengths or high-entropy parameter values targeting LOGINFRM_CATOLD.ASP.
Track authentication anomalies such as impossible-travel logins or session-token reuse that may follow a successful XSS-driven credential theft.
Review browser telemetry from managed endpoints for JavaScript errors or blocked script executions on the e-TMS origin.

How to Mitigate CVE-2025-59757

Immediate Actions Required

Restrict external access to /clt/LOGINFRM_CATOLD.ASP at the perimeter until a vendor patch is applied.
Contact AndSoft support to obtain a fixed build of e-TMS and confirm remediation status for v25.03.
Warn e-TMS users to avoid clicking e-TMS links received from untrusted sources and to authenticate only via bookmarked URLs.

Patch Information

AndSoft has been notified through INCIBE-CERT coordinated disclosure. Refer to the INCIBE Security Notice for current patch availability and upgrade guidance. Organizations running e-TMS v25.03 should engage the vendor directly to confirm the fixed version.

Workarounds

Configure a WAF rule set (for example, OWASP ModSecurity Core Rule Set) to block script metacharacters in the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters.
Add a strict Content-Security-Policy response header that disallows inline scripts (script-src 'self') on all /clt/ responses.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of JavaScript-based cookie theft.
Enforce SameSite=Strict cookie attributes to limit cross-site request abuse following an XSS event.

bash

# Example ModSecurity rule blocking script payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /clt/LOGINFRM_CATOLD.ASP" \
  "chain,deny,status:403,id:1005975701,msg:'CVE-2025-59757 XSS attempt'"
  SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
    "@rx (?i)(<script|onerror=|onload=|javascript:)"