CVE-2025-59764: Andsoft E-tms XSS Vulnerability

CVE-2025-59764 Overview

CVE-2025-59764 is a reflected Cross-Site Scripting (XSS) vulnerability in AndSoft's e-TMS v25.03, a Transport Management System used in logistics operations. The flaw affects the /clt/LOGINFRM_FCC.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input. Attackers can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when clicked. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can hijack authenticated user sessions, steal credentials, or perform actions on behalf of victims in the e-TMS logistics platform by delivering crafted URLs.

Affected Products

AndSoft e-TMS v25.03
/clt/LOGINFRM_FCC.ASP endpoint
Parameters: l, demo, demo2, TNTLOGIN, UO, SuppConn

Discovery Timeline

2025-10-02 - CVE-2025-59764 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59764

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw in the login form handler of AndSoft e-TMS v25.03. The application reflects user-controlled query string values back into the HTTP response without applying output encoding or input validation. When a victim opens a crafted URL, the browser parses attacker-supplied JavaScript as legitimate page content and executes it in the origin context of the e-TMS application.

An attacker with no prior authentication can weaponize this flaw by embedding a malicious payload into any of the six affected parameters. Successful exploitation yields JavaScript execution in the victim's session context, enabling session cookie theft, credential harvesting via injected fake login forms, and unauthorized transport management actions. Because e-TMS handles freight, dispatch, and supply chain data, compromised sessions can expose sensitive logistics information.

Root Cause

The root cause is missing output encoding on parameter values processed by /clt/LOGINFRM_FCC.ASP. The Classic ASP page writes the l, demo, demo2, TNTLOGIN, UO, and SuppConn query string values directly into the rendered HTML without HTML entity encoding or context-aware sanitization. This maps to [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted URL through phishing email, malicious link on a third-party site, or messaging channels. When the victim clicks the link, the vulnerable ASP page reflects the payload into the response body. The browser executes the injected script under the e-TMS domain, giving the attacker access to any session cookies not protected by HttpOnly and to the Document Object Model (DOM) of the application.

A typical attack chain injects <script> tags or event handlers into one of the six vulnerable parameters. Refer to the INCIBE CERT Security Notice for technical details on the disclosed parameters and payload structure.

Detection Methods for CVE-2025-59764

Indicators of Compromise

HTTP requests to /clt/LOGINFRM_FCC.ASP containing script tags, javascript: URIs, or HTML event handlers such as onerror= and onload= in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Referrer headers pointing to external domains preceding requests to the login form endpoint.
Unusual outbound requests from browsers to attacker-controlled hosts immediately after a user visits the e-TMS login page.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings for the affected parameters and block reflected XSS payloads.
Enable server-side logging on the /clt/LOGINFRM_FCC.ASP endpoint and alert on requests containing URL-encoded <, >, or script tokens.
Correlate authentication events with anomalous session cookie usage from geographically inconsistent source IPs.

Monitoring Recommendations

Monitor web server logs for HTTP GET requests to the login form URL containing non-alphanumeric characters in the six vulnerable parameters.
Track user-agent and referrer anomalies on the e-TMS domain to identify phishing-driven traffic patterns.
Alert on outbound HTTP requests from browser processes to newly registered or low-reputation domains following e-TMS session activity.

How to Mitigate CVE-2025-59764

Immediate Actions Required

Contact AndSoft to confirm patch availability for e-TMS v25.03 and apply vendor-supplied updates as soon as they are released.
Deploy WAF rules that reject requests to /clt/LOGINFRM_FCC.ASP containing HTML tags or JavaScript keywords in the affected parameters.
Educate users on the risk of clicking untrusted links referencing the e-TMS domain, particularly from unsolicited email or messaging.

Patch Information

At the time of publication, no vendor patch URL is listed in the NVD record. Refer to the INCIBE CERT Security Notice for the latest remediation guidance from the coordinating CSIRT and coordinate directly with AndSoft support for a fixed build.

Workarounds

Configure a reverse proxy or WAF to strip or reject query string values containing <, >, ", ', or javascript: on the affected endpoint.
Set the HttpOnly and Secure flags on all session cookies to reduce the impact of successful script execution.
Deploy a strict Content Security Policy (CSP) header on the e-TMS application to block inline script execution.
Restrict access to the e-TMS application to trusted networks or VPN users where operationally feasible.

bash

# Example WAF rule (ModSecurity) to block reflected XSS on the vulnerable endpoint
SecRule REQUEST_URI "@contains /clt/LOGINFRM_FCC.ASP" \
    "chain,phase:2,deny,status:403,id:1005976,msg:'CVE-2025-59764 e-TMS XSS attempt'"
    SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
        "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)"

# Response header hardening (IIS web.config)
# <httpProtocol>
#   <customHeaders>
#     <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self'" />
#     <add name="X-XSS-Protection" value="1; mode=block" />
#   </customHeaders>
# </httpProtocol>