CVE-2025-59766: Andsoft E-tms XSS Vulnerability

CVE-2025-59766 Overview

CVE-2025-59766 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03, a transportation management system. The flaw exists in the /clt/LOGINFRM_LT.ASP endpoint, where multiple parameters accept unsanitized input that is reflected back in the HTTP response. Attackers can craft malicious URLs containing JavaScript payloads in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters. When a victim clicks such a URL, the injected script executes in their browser under the application's origin. The vulnerability is categorized as [CWE-79] and requires user interaction to succeed.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, potentially stealing credentials or hijacking authenticated sessions on the e-TMS platform.

Affected Products

AndSoft e-TMS v25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03
Component: andsoft:e-tms

Discovery Timeline

2025-10-02 - CVE-2025-59766 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59766

Vulnerability Analysis

The vulnerability resides in the login form handler at /clt/LOGINFRM_LT.ASP. This Classic ASP script accepts six user-controlled parameters: l, demo, demo2, TNTLOGIN, UO, and SuppConn. The application reflects these parameter values into the HTML response without applying proper output encoding or input sanitization. An attacker can inject HTML and JavaScript directly into the rendered page. The reflected nature means each attack requires delivering a crafted URL to a target, typically via phishing or social engineering. Successful exploitation runs attacker-controlled JavaScript in the context of the e-TMS domain, enabling session token theft, credential harvesting via fake login overlays, or unauthorized actions against the transportation management system.

Root Cause

The root cause is missing output encoding [CWE-79] on request parameters embedded in the HTML response. The LOGINFRM_LT.ASP handler passes untrusted query string or form values directly into the response body without HTML-entity escaping or context-aware sanitization.

Attack Vector

Exploitation occurs over the network and requires the victim to click a crafted link. The attacker builds a URL to the vulnerable e-TMS endpoint with a JavaScript payload injected into one of the affected parameters. When the victim visits the URL while browsing to the e-TMS portal, the server reflects the payload into the page, and the browser executes it. See the INCIBE Security Notice for vendor coordination details.

Detection Methods for CVE-2025-59766

Indicators of Compromise

HTTP requests to /clt/LOGINFRM_LT.ASP containing URL-encoded <script>, javascript:, or event handler strings such as onerror= and onload= in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Referrer headers from external or unexpected domains directed at the e-TMS login form.
Anomalous outbound requests from client browsers to attacker-controlled domains following visits to the login page.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters for XSS payloads targeting the six affected parameter names.
Enable verbose web server logging on the e-TMS host and parse for suspicious character sequences (<, >, %3C, %3E) in the identified parameters.
Correlate login page traffic with phishing campaigns or unusual referrer patterns using SIEM analytics.

Monitoring Recommendations

Alert on any request to /clt/LOGINFRM_LT.ASP with parameter values exceeding normal length thresholds or containing HTML tags.
Monitor authenticated e-TMS sessions for concurrent logins from disparate IP addresses following login page visits.
Track Content Security Policy (CSP) violation reports if CSP headers are deployed on the application.

How to Mitigate CVE-2025-59766

Immediate Actions Required

Contact AndSoft to obtain patched builds of e-TMS beyond v25.03 and schedule deployment.
Restrict access to /clt/LOGINFRM_LT.ASP at the network perimeter until patched, allowing only trusted client networks.
Educate e-TMS users to avoid clicking login links delivered via email, chat, or external websites.
Rotate credentials for accounts that may have interacted with suspicious URLs targeting the login page.

Patch Information

AndSoft has been notified via INCIBE-CERT. Refer to the INCIBE Security Notice for the current patch status and contact AndSoft directly for a fixed release.

Workarounds

Deploy WAF signatures that block or sanitize requests containing HTML metacharacters in the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters.
Add HTTP response headers including Content-Security-Policy, X-XSS-Protection, and X-Content-Type-Options: nosniff on the e-TMS web server to reduce exploitability.
Enforce HttpOnly and Secure flags on session cookies to limit the impact of script execution.

bash

# Example ModSecurity rule to block XSS payloads in vulnerable parameters
SecRule ARGS_NAMES "@rx ^(l|demo|demo2|TNTLOGIN|UO|SuppConn)$" \
    "chain,phase:2,deny,status:403,id:1005976,\
    msg:'CVE-2025-59766 XSS attempt on e-TMS LOGINFRM_LT.ASP'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"