CVE-2025-59759: Andsoft E-tms XSS Vulnerability

CVE-2025-59759 Overview

CVE-2025-59759 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transport management software version 25.03. The flaw resides in the /clt/LOGINFRM_DELCROIX.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters are reflected without proper sanitization. An attacker can craft a malicious URL that, when opened by an authenticated or unauthenticated victim, executes arbitrary JavaScript in the victim's browser session. The vulnerability is tracked under [CWE-79] and was disclosed through INCIBE-CERT.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser, enabling session token theft, credential harvesting through fake login overlays, and unauthorized actions against the e-TMS application.

Affected Products

AndSoft e-TMS version 25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03:*:*:*:*:*:*:*
Vulnerable endpoint: /clt/LOGINFRM_DELCROIX.ASP

Discovery Timeline

2025-10-02 - CVE-2025-59759 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59759

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the login form handler at /clt/LOGINFRM_DELCROIX.ASP. The ASP page echoes the values of the l, demo, demo2, TNTLOGIN, UO, and SuppConn query parameters into the HTTP response without HTML encoding or context-aware output escaping. When a victim follows a specially crafted link, the injected payload renders as executable JavaScript inside the page's Document Object Model (DOM).

Because the vulnerable endpoint is the login form itself, exploitation is possible before authentication. This expands the attack surface to any user tricked into clicking a phishing link that references the legitimate e-TMS host. Injected scripts run in the origin of the e-TMS application and can read cookies not marked HttpOnly, modify DOM content to spoof credential prompts, and issue authenticated requests once a user logs in.

Root Cause

The root cause is missing output encoding of user-controlled request parameters. The ASP handler concatenates request values directly into the rendered HTML response instead of escaping characters such as <, >, ", ', and & per output context. This is a classic Improper Neutralization of Input During Web Page Generation weakness [CWE-79].

Attack Vector

Exploitation requires user interaction. The attacker distributes a URL such as https://<victim-host>/clt/LOGINFRM_DELCROIX.ASP?l=<payload> where <payload> contains a <script> tag or event handler. Delivery vectors include phishing email, malicious advertising, chat messages, and links from compromised sites. No prior authentication or elevated privileges are required to trigger the payload.

No public proof-of-concept exploit or exploit database entry is currently listed for this CVE. See the INCIBE Security Notice for coordinated disclosure details.

Detection Methods for CVE-2025-59759

Indicators of Compromise

Inbound HTTP GET or POST requests to /clt/LOGINFRM_DELCROIX.ASP containing <script, javascript:, onerror=, onload=, or URL-encoded equivalents (%3Cscript) in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Referer headers on requests to e-TMS originating from unexpected external domains, suggesting link-based delivery.
Unusual outbound requests from client browsers to attacker-controlled domains immediately after visiting the login page.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings and form bodies to /clt/LOGINFRM_DELCROIX.ASP for XSS signatures across all six affected parameters.
Enable browser Content Security Policy (CSP) violation reporting to surface script injections that bypass server-side controls.
Review web server access logs for repeated requests to the vulnerable endpoint with encoded angle brackets, quotes, or common XSS test strings such as alert(1).

Monitoring Recommendations

Correlate authentication events with recent visits to the login page carrying suspicious parameters to identify potential session hijack attempts.
Alert on user-agent patterns and geographic anomalies for successful logins that followed a flagged XSS request.
Aggregate WAF, proxy, and endpoint telemetry into a centralized data lake to reconstruct multi-stage phishing-plus-XSS attack chains.

How to Mitigate CVE-2025-59759

Immediate Actions Required

Consult the INCIBE Security Notice and contact AndSoft support to obtain a fixed build of e-TMS beyond version 25.03.
Restrict access to /clt/LOGINFRM_DELCROIX.ASP at the WAF or reverse proxy layer, blocking requests whose parameter values contain HTML metacharacters.
Educate users, especially transport and logistics operators, to avoid clicking e-TMS links from untrusted sources or unsolicited email.

Patch Information

AndSoft has not published a public patch identifier in the NVD record. Customers should engage the vendor directly to confirm the fixed version and upgrade path. Reference the INCIBE-CERT advisory for coordinated remediation guidance.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing exploit impact.
Mark session cookies with the HttpOnly and Secure attributes to prevent JavaScript access to authentication tokens.
Implement server-side input validation and output encoding at a proxy or ASP filter layer for the six affected parameters until a vendor patch is applied.

bash

# Example ModSecurity rule to block XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_DELCROIX.ASP" \
  "phase:2,chain,deny,status:403,log,msg:'CVE-2025-59759 XSS attempt'"
  SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
    "@rx (?i)(<script|javascript:|on\w+\s*=|%3Cscript)"