CVE-2025-59767: Andsoft E-tms XSS Vulnerability

CVE-2025-59767 Overview

CVE-2025-59767 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transport management software version 25.03. The flaw resides in the /clt/LOGINFRM_LVE.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser session when opened. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser through a crafted link, enabling session token theft, credential harvesting, and unauthorized actions within the e-TMS application.

Affected Products

AndSoft e-TMS version 25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03:*:*:*:*:*:*:*
Endpoint: /clt/LOGINFRM_LVE.ASP

Discovery Timeline

2025-10-02 - CVE-2025-59767 published to NVD
2026-06-17 - Last updated in NVD database

Details were coordinated through INCIBE-CERT, which issued a public security notice covering multiple vulnerabilities in AndSoft e-TMS.

Technical Details for CVE-2025-59767

Vulnerability Analysis

The vulnerability is a reflected XSS flaw affecting the login form handler at /clt/LOGINFRM_LVE.ASP. The application reflects the values of six request parameters (l, demo, demo2, TNTLOGIN, UO, and SuppConn) directly into the HTML response without applying output encoding or input validation. An attacker who convinces a target to click a crafted link can inject JavaScript that runs in the origin of the e-TMS deployment.

Because e-TMS is a transport management system typically used by logistics operators, successful exploitation can expose shipment data, customer records, and operational workflows. Payloads executing under an authenticated user's session inherit that user's privileges within the application.

Root Cause

The root cause is missing output encoding on parameters echoed by the classic ASP page LOGINFRM_LVE.ASP. User-controlled query string values reach the response body without HTML entity encoding or contextual escaping, allowing script tags and event handlers to be interpreted by the browser.

Attack Vector

Exploitation requires network access to the e-TMS web interface and user interaction, typically through a phishing email or a malicious link posted where legitimate users will encounter it. The victim's browser sends the malicious parameters to the vulnerable endpoint, which reflects them into the response. No prior authentication is required to trigger the reflection, though impact increases significantly if the victim holds an active session.

The vulnerability affects confidentiality and integrity of data accessible in the victim's browser context, including cookies not protected by HttpOnly and any content rendered by the application.

Detection Methods for CVE-2025-59767

Indicators of Compromise

Web server access logs showing requests to /clt/LOGINFRM_LVE.ASP containing suspicious characters such as <, >, script, onerror, or URL-encoded equivalents (%3Cscript, %3E) within the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Referrer headers pointing to external domains or URL shorteners immediately preceding requests to LOGINFRM_LVE.ASP with unusual query strings.
Outbound requests from user workstations to unfamiliar domains shortly after a user visits an e-TMS login URL.

Detection Strategies

Deploy web application firewall (WAF) rules that flag reflected script content in requests to /clt/LOGINFRM_LVE.ASP.
Enable request logging and search historical logs for the six affected parameter names paired with HTML or JavaScript syntax.
Correlate proxy telemetry with endpoint browser telemetry to identify users who clicked crafted e-TMS URLs.

Monitoring Recommendations

Monitor for anomalous authentication events and session token reuse from geographically distant IP addresses following e-TMS access.
Alert on browser extensions or endpoint agents reporting DOM modifications triggered by e-TMS response pages.
Track email gateway detections for messages containing links to the e-TMS login endpoint with encoded payloads.

How to Mitigate CVE-2025-59767

Immediate Actions Required

Contact AndSoft to obtain a fixed release or hotfix for e-TMS v25.03 and apply it once available.
Restrict access to the e-TMS web interface to trusted networks or VPN clients until a patch is deployed.
Educate users on the risk of clicking unsolicited links referencing the e-TMS login page.

Patch Information

At the time of publication, AndSoft has not listed a public patch identifier in the NVD entry. Refer to the INCIBE-CERT advisory for vendor coordination details and follow AndSoft support channels for release notes covering this issue.

Workarounds

Deploy WAF signatures that block requests to /clt/LOGINFRM_LVE.ASP containing <, >, or script tokens in the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters.
Enforce a strict Content-Security-Policy response header on the application to block inline script execution.
Set the HttpOnly and Secure flags on session cookies to reduce impact from script-based cookie theft.
Configure browsers and email gateways to strip or warn on URLs containing encoded HTML in query parameters targeting the e-TMS host.

bash

# Example ModSecurity rule to block reflected payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /clt/LOGINFRM_LVE.ASP" \
    "phase:2,chain,deny,status:403,id:1005967,\
    msg:'Potential XSS against AndSoft e-TMS CVE-2025-59767'"
    SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
        "@rx (?i)(<script|onerror=|javascript:|%3Cscript)"