CVE-2025-59760: Andsoft E-tms XSS Vulnerability

CVE-2025-59760 Overview

CVE-2025-59760 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03, a transportation management system. The flaw resides in the /clt/LOGINFRM_DHL.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input. An attacker can craft a malicious URL that, when opened by an authenticated or unauthenticated victim, executes arbitrary JavaScript in the victim's browser under the application's origin. The issue is tracked under CWE-79 and was disclosed through the Spanish national CERT.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting through fake login overlays, and unauthorized actions against the e-TMS application.

Affected Products

AndSoft e-TMS version 25.03
Deployments exposing /clt/LOGINFRM_DHL.ASP to untrusted networks
Web clients interacting with vulnerable e-TMS endpoints

Discovery Timeline

2025-10-02 - CVE-2025-59760 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59760

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the DHL login handler of e-TMS v25.03. The ASP page /clt/LOGINFRM_DHL.ASP echoes multiple query-string parameters back into the HTML response without applying output encoding or input validation. An attacker who convinces a user to click a crafted link can inject JavaScript that runs in the context of the e-TMS web origin.

Because e-TMS is a transportation management platform, hijacked sessions may expose shipment data, customer accounts, and logistics workflows. Reflected XSS also enables phishing overlays that mimic the legitimate login form to capture credentials. User interaction is required, which limits mass exploitation but remains practical through targeted spear-phishing against dispatchers, agents, and integration partners.

Root Cause

The root cause is missing output encoding on the l, demo, demo2, TNTLOGIN, UO, and SuppConn request parameters. The ASP script inserts these values directly into the HTML response, allowing angle brackets, quotes, and script tags to break out of their intended context. This is a classic instance of improper neutralization of input during web page generation, categorized under CWE-79.

Attack Vector

Exploitation is network-based and requires the victim to open a malicious link. The attacker crafts a URL to /clt/LOGINFRM_DHL.ASP embedding a JavaScript payload in one of the six vulnerable parameters. When the server reflects the payload into the response, the browser executes it. Payloads can exfiltrate cookies, submit forged forms, or pivot to internal API calls available to the authenticated user.

The vulnerability manifests in URL parameter handling within the login form. See the INCIBE CERT Advisory on Vulnerabilities for technical details.

Detection Methods for CVE-2025-59760

Indicators of Compromise

Web server access logs containing requests to /clt/LOGINFRM_DHL.ASP with URL-encoded <script>, onerror=, onload=, or javascript: strings in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters
Unusual outbound HTTP requests from user browsers to attacker-controlled domains immediately after visiting the login page
Session tokens or cookies for e-TMS accounts appearing in unexpected geographies or user agents

Detection Strategies

Deploy a web application firewall rule that flags reflected XSS patterns targeting the affected ASP endpoint and its six parameters
Perform continuous fuzzing of the login parameters with XSS payloads in staging to confirm the presence or absence of the vulnerability after patching
Correlate proxy telemetry with email gateway logs to surface phishing campaigns delivering malicious e-TMS URLs to employees

Monitoring Recommendations

Alert on HTTP requests to /clt/LOGINFRM_DHL.ASP where parameter values contain HTML metacharacters such as <, >, or "
Monitor for anomalous authentication events on e-TMS accounts that follow user clicks on external referrers
Track Content Security Policy (CSP) violation reports if CSP is deployed in front of e-TMS

How to Mitigate CVE-2025-59760

Immediate Actions Required

Contact AndSoft to obtain and apply the vendor fix for e-TMS v25.03 as referenced in the INCIBE CERT Advisory on Vulnerabilities
Restrict access to /clt/LOGINFRM_DHL.ASP to trusted networks or VPN users until the patch is deployed
Notify e-TMS users to avoid clicking unsolicited links pointing at the e-TMS domain and to report suspicious URLs

Patch Information

AndSoft has coordinated remediation through INCIBE-CERT. Administrators should reference the INCIBE CERT Advisory on Vulnerabilities for the current fixed release and upgrade instructions from the vendor. No public exploit or CISA KEV listing is associated with this CVE at the time of writing.

Workarounds

Deploy a WAF signature that blocks requests to /clt/LOGINFRM_DHL.ASP containing HTML control characters or common XSS keywords in the six vulnerable parameters
Enforce a strict Content Security Policy that disallows inline scripts and unknown script sources for the e-TMS application
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution

bash

# Example ModSecurity rule to block XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_DHL.ASP" \
  "chain,phase:2,deny,status:403,id:5976001,\
   msg:'CVE-2025-59760 e-TMS reflected XSS attempt'"
  SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
    "@rx (?i)(<script|onerror=|onload=|javascript:|<svg|<img[^>]+src)"