CVE-2025-59758: Andsoft E-tms XSS Vulnerability

CVE-2025-59758 Overview

CVE-2025-59758 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03, a transportation management system. The flaw resides in the /clt/LOGINFRM_CYLOG.ASP endpoint, where multiple parameters, including l, demo, demo2, TNTLOGIN, UO, and SuppConn, fail to sanitize user-supplied input before reflecting it in the HTTP response. An attacker crafts a malicious URL and delivers it to a victim through phishing or social engineering. When the target opens the link, arbitrary JavaScript executes in the browser under the application's origin. The weakness is classified under CWE-79.

Critical Impact
Successful exploitation allows attackers to execute JavaScript in a victim's authenticated session, enabling credential theft, session hijacking, and unauthorized actions against the e-TMS platform.

Affected Products

AndSoft e-TMS version 25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03:*:*:*:*:*:*:*
Endpoint: /clt/LOGINFRM_CYLOG.ASP

Discovery Timeline

2025-10-02 - CVE-2025-59758 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59758

Vulnerability Analysis

The vulnerability affects the login form handler at /clt/LOGINFRM_CYLOG.ASP in AndSoft's e-TMS v25.03. The application reflects the values of the l, demo, demo2, TNTLOGIN, UO, and SuppConn query parameters into the rendered HTML response without proper output encoding or input validation.

Because the injection point is reflected rather than stored, exploitation requires user interaction. An attacker constructs a URL containing JavaScript payloads embedded in one or more of the vulnerable parameters and delivers it to targets. The browser then parses the injected script as part of the trusted response.

The impact is scoped to the browser context. Attackers can steal session cookies, capture credentials entered on the login form, perform actions on behalf of authenticated users, or pivot to further attacks against internal logistics workflows managed by e-TMS.

Root Cause

The root cause is missing or insufficient output encoding on parameters reflected into the login page markup. The application trusts client-supplied input and inserts it directly into the HTML context. Standard defenses such as HTML entity encoding, context-aware escaping, and a strict Content Security Policy are absent for the affected parameters.

Attack Vector

Exploitation occurs over the network and requires user interaction. The attacker crafts a URL targeting /clt/LOGINFRM_CYLOG.ASP with a malicious payload in one of the vulnerable parameters. The victim must click the link, at which point the reflected script executes in the victim's browser. No authentication is required to deliver the payload.

Technical details are documented in the INCIBE Security Notice.

Detection Methods for CVE-2025-59758

Indicators of Compromise

Inbound HTTP requests to /clt/LOGINFRM_CYLOG.ASP containing script tags, javascript: URIs, event handlers (onerror, onload), or URL-encoded equivalents in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Referrer headers on outbound requests from user endpoints originating from suspicious URLs targeting the e-TMS login page.
Anomalous JavaScript activity on client browsers loading the e-TMS login form, including unexpected cross-origin requests to attacker-controlled hosts.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect query strings on /clt/LOGINFRM_CYLOG.ASP for XSS payload patterns.
Correlate email gateway logs with web proxy logs to identify users who clicked URLs pointing to e-TMS with suspicious query parameters.
Review server access logs for requests containing encoded angle brackets (%3C, %3E) or common XSS keywords targeting the affected parameters.

Monitoring Recommendations

Enable verbose logging on the e-TMS web server and forward logs to a SIEM for retention and query.
Monitor authentication anomalies such as session reuse from unexpected IP addresses following clicks on external links.
Alert on outbound HTTP requests from user endpoints to newly registered or low-reputation domains referenced within phishing lures targeting logistics staff.

How to Mitigate CVE-2025-59758

Immediate Actions Required

Contact AndSoft to confirm patch availability for e-TMS v25.03 and apply vendor-supplied updates as soon as they are released.
Deploy WAF rules to block requests containing script payloads or HTML metacharacters in the affected parameters on /clt/LOGINFRM_CYLOG.ASP.
Educate users, particularly logistics and administrative staff, on the risk of clicking unsolicited links referencing the e-TMS platform.

Patch Information

Refer to the INCIBE Security Notice for the latest vendor guidance. At the time of publication, no vendor advisory URL was listed in the NVD entry beyond the INCIBE reference. Contact AndSoft directly for a fixed release.

Workarounds

Enforce a strict Content Security Policy (CSP) at a reverse proxy or WAF layer to restrict inline script execution on e-TMS pages.
Restrict network access to the e-TMS login interface using VPN or IP allowlisting to reduce exposure to untrusted networks.
Configure browser-side defenses such as HttpOnly and Secure flags on session cookies to limit the impact of script execution.

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on the affected endpoint
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_CYLOG.ASP" \
    "chain,phase:2,deny,status:403,id:1005975,msg:'CVE-2025-59758 XSS attempt'"
    SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
        "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)"