CVE-2025-59763: Andsoft E-tms XSS Vulnerability

CVE-2025-59763 Overview

CVE-2025-59763 is a reflected Cross-Site Scripting (XSS) vulnerability affecting AndSoft's e-TMS v25.03, a transportation management system. The flaw resides in the /clt/LOGINFRM_EK.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input. Attackers can craft a malicious URL that, when opened by an authenticated or unauthenticated victim, executes arbitrary JavaScript in the victim's browser context. The vulnerability is tracked under [CWE-79] and is documented in the Incibe Security Notice.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions within the e-TMS application.

Affected Products

AndSoft e-TMS v25.03
Deployments exposing /clt/LOGINFRM_EK.ASP to untrusted networks
Environments where users can be lured to malicious URLs targeting the login form

Discovery Timeline

2025-10-02 - CVE-2025-59763 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59763

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the login form handler at /clt/LOGINFRM_EK.ASP. The endpoint echoes several query string parameters back into the HTTP response without proper output encoding. Six parameters are affected: l, demo, demo2, TNTLOGIN, UO, and SuppConn. Any of these can carry a JavaScript payload that the server reflects into the rendered HTML. Because the injection point is reached before authentication, no valid session or credentials are required to trigger execution. Successful exploitation requires user interaction, typically clicking a crafted link delivered via phishing, chat, or a compromised referrer. The EPSS score is 0.181%, placing it in the lower percentile of actively exploited vulnerabilities, but reflected XSS in a business application remains attractive for targeted phishing campaigns against logistics operators.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled parameters echoed into the HTML response. The ASP page appears to write parameter values directly into the document, likely inside script blocks, HTML attributes, or form fields, without applying context-aware HTML entity encoding. This maps directly to [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker crafts a URL such as https://<target>/clt/LOGINFRM_EK.ASP?l=<script>...</script> and delivers it to a victim via phishing. When the victim clicks the link, the e-TMS server reflects the payload into the login page HTML, and the browser executes it in the origin of the e-TMS deployment. The attacker can then exfiltrate cookies, capture credentials entered into the login form, or pivot to internal transport management functions if the victim later authenticates.

Detection Methods for CVE-2025-59763

Indicators of Compromise

HTTP requests to /clt/LOGINFRM_EK.ASP containing <script>, javascript:, onerror=, or URL-encoded equivalents in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters
Referrer headers pointing to unknown domains preceding requests to the login endpoint
Outbound connections from user browsers to attacker-controlled hosts immediately after visiting e-TMS URLs

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters on /clt/LOGINFRM_EK.ASP for HTML and JavaScript metacharacters
Correlate web server access logs with email gateway data to identify users who followed suspicious inbound links to the e-TMS host
Hunt for anomalous parameter lengths or encoded payloads in historical IIS or ASP logs

Monitoring Recommendations

Enable full URI logging on the web server hosting e-TMS, including query strings
Forward web logs to a centralized analytics platform for retention and search across the affected parameter set
Monitor for unusual session activity, such as concurrent logins from disparate geolocations, following user interaction with external links

How to Mitigate CVE-2025-59763

Immediate Actions Required

Contact AndSoft to obtain the fixed release of e-TMS and confirm the patch level addressing the six affected parameters
Restrict access to /clt/LOGINFRM_EK.ASP to trusted networks or via VPN until a patch is applied
Notify users of the phishing risk and instruct them to avoid clicking e-TMS links received from untrusted sources

Patch Information

AndSoft has published guidance through the Spanish national CERT. Refer to the Incibe Security Notice for the current fixed version and vendor remediation steps. Upgrade beyond v25.03 as soon as the vendor-supplied release is available.

Workarounds

Deploy WAF signatures that block or sanitize the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters when they contain script tags or event handlers
Set a strict Content-Security-Policy response header on the e-TMS site to disallow inline scripts and restrict script sources
Configure HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution

bash

# Example WAF rule (ModSecurity) to block reflected XSS payloads on the affected endpoint
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_EK.ASP" \
  "chain,phase:2,deny,status:403,id:1059763,msg:'CVE-2025-59763 XSS attempt'"
  SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
    "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"