CVE-2025-59762: Andsoft E-tms XSS Vulnerability

CVE-2025-59762 Overview

CVE-2025-59762 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03, a transportation management system. Attackers can execute arbitrary JavaScript in a victim's browser by delivering a malicious URL that targets the /clt/LOGINFRM_DLG.ASP endpoint. The vulnerable parameters are l, demo, demo2, TNTLOGIN, UO, and SuppConn. The flaw stems from improper neutralization of user-supplied input reflected in the login page response [CWE-79]. Exploitation requires user interaction, typically through a phishing link or social engineering. Successful attacks can lead to session token theft, credential harvesting through injected login overlays, and unauthorized actions performed in the victim's authenticated context.

Critical Impact
Attackers who trick authenticated e-TMS users into clicking a crafted URL can hijack sessions, steal credentials, and pivot into logistics workflows.

Affected Products

AndSoft e-TMS version 25.03
AndSoft e-TMS login module (/clt/LOGINFRM_DLG.ASP)
Deployments exposing the login dialog to untrusted networks

Discovery Timeline

2025-10-02 - CVE-2025-59762 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59762

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the e-TMS login dialog page located at /clt/LOGINFRM_DLG.ASP. The Classic ASP handler accepts several query string parameters and reflects their values into the rendered HTML without encoding. When an attacker supplies JavaScript payloads within l, demo, demo2, TNTLOGIN, UO, or SuppConn, the browser parses and executes the injected script in the origin of the e-TMS application. Because the payload runs under the application origin, it can read cookies not marked HttpOnly, issue authenticated requests, and manipulate the DOM to capture keystrokes entered into the login form.

Root Cause

The root cause is missing output encoding on user-controlled input echoed into the ASP-generated login page. The application concatenates request parameter values directly into HTML context without applying HTML entity encoding or a Content Security Policy that would block inline script execution. This mapping of untrusted query strings to executable HTML is a textbook [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL to /clt/LOGINFRM_DLG.ASP embedding a JavaScript payload in one of the affected parameters and delivers it via email, chat, or a compromised website. When a logged-in or soon-to-log-in e-TMS user visits the URL, the payload executes in the browser session. See the INCIBE Security Notice for additional context on this and related e-TMS advisories.

No verified public proof-of-concept code is available. The vulnerability follows the standard reflected XSS pattern: a payload such as a <script> tag embedded in one of the six named query parameters is returned unescaped in the server response and executed by the victim's browser.

Detection Methods for CVE-2025-59762

Indicators of Compromise

Web server access logs showing requests to /clt/LOGINFRM_DLG.ASP with query string values containing <script, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript
Unusually long or base64-encoded values in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters
Referrer headers on login requests pointing to external, unexpected domains

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters on /clt/LOGINFRM_DLG.ASP for common XSS token patterns and reject or sanitize matching requests
Enable browser Content Security Policy reporting to capture inline script violations originating from the e-TMS login page
Correlate outbound requests from user browsers to attacker-controlled domains immediately after visits to the e-TMS login URL

Monitoring Recommendations

Alert on HTTP 200 responses to /clt/LOGINFRM_DLG.ASP where request parameters contain HTML tag characters
Monitor for suspicious session token reuse across geographically distant IP addresses following login events
Review email gateway logs for URLs referencing the e-TMS login endpoint with encoded script fragments

How to Mitigate CVE-2025-59762

Immediate Actions Required

Contact AndSoft to confirm availability of a fixed release for e-TMS v25.03 and schedule deployment
Restrict access to /clt/LOGINFRM_DLG.ASP from untrusted networks using network ACLs or VPN gating
Enforce a strict Content Security Policy on the e-TMS site that disallows inline scripts and unknown script sources
Mark session cookies as HttpOnly, Secure, and SameSite=Lax to limit the impact of injected JavaScript

Patch Information

At the time of NVD publication no vendor patch URL is listed in the advisory. Refer to the INCIBE Security Notice for coordinated disclosure updates and contact AndSoft support for the fixed build addressing the reflected XSS in the login dialog parameters.

Workarounds

Configure a reverse proxy or WAF to strip or reject requests to /clt/LOGINFRM_DLG.ASP containing angle brackets, javascript: URIs, or event handler attributes in the affected parameters
Train users to access e-TMS only through bookmarks or the internal portal and to avoid clicking login links delivered via email
Disable or remove the vulnerable parameters at the reverse proxy layer if they are not required for legitimate authentication flows

bash

# Example ModSecurity rule to block reflected XSS attempts against the e-TMS login dialog
SecRule REQUEST_URI "@contains /clt/LOGINFRM_DLG.ASP" \
    "chain,phase:2,deny,status:403,id:1005976,\
    msg:'CVE-2025-59762 e-TMS reflected XSS attempt'"
  SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
    "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "t:none,t:urlDecodeUni"