CVE-2025-59768: Andsoft E-tms XSS Vulnerability

CVE-2025-59768 Overview

CVE-2025-59768 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transportation management system, version 25.03. The flaw resides in the /clt/LOGINFRM_MNG.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters reflect unsanitized user input into the response. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser once clicked. The vulnerability is tracked under [CWE-79] and requires user interaction to trigger. Spain's INCIBE-CERT published the coordinated advisory.

Critical Impact
Successful exploitation lets attackers execute JavaScript in an authenticated user's browser session, enabling credential theft, session hijacking against the e-TMS logistics portal, and phishing pivots.

Affected Products

AndSoft e-TMS version 25.03
Vulnerable endpoint: /clt/LOGINFRM_MNG.ASP
Vulnerable parameters: l, demo, demo2, TNTLOGIN, UO, SuppConn

Discovery Timeline

2025-10-02 - CVE-2025-59768 published to NVD
2026-06-17 - Last updated in NVD database
Reference advisory - INCIBE-CERT Security Notice on AndSoft e-TMS

Technical Details for CVE-2025-59768

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the login management page of AndSoft's e-TMS platform. The application receives HTTP request parameters and writes their values into the HTML response without proper output encoding or input validation. When a victim loads the crafted URL, the injected script executes within the origin of the e-TMS application.

Because the flaw is reflected rather than stored, exploitation requires the victim to click a prepared link. Attackers typically deliver such links through phishing emails, chat platforms, or malicious redirects. The context is the login page, which increases the value of harvested credentials for downstream account takeover.

Root Cause

The root cause is missing neutralization of special characters in six request parameters processed by /clt/LOGINFRM_MNG.ASP. The Classic ASP handler concatenates user-controlled values into the HTML response without HTML entity encoding, permitting <script> tags or event handler payloads to break out of the intended attribute or text context.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL such as https://<victim-e-tms-host>/clt/LOGINFRM_MNG.ASP?l=<payload> where <payload> contains JavaScript. Once the victim loads the URL, the browser renders and executes the reflected payload against the e-TMS origin, granting the attacker access to cookies, form fields, and the DOM of the login interface.

No verified proof-of-concept code is publicly indexed. The vulnerability mechanism is described in prose based on the parameter list disclosed by INCIBE-CERT. See the INCIBE-CERT advisory for coordinated disclosure details.

Detection Methods for CVE-2025-59768

Indicators of Compromise

Web server access logs showing GET or POST requests to /clt/LOGINFRM_MNG.ASP containing <, >, script, onerror, onload, or URL-encoded equivalents (%3C, %3E) in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Outbound HTTP requests from user browsers to unfamiliar domains immediately after visiting the e-TMS login page, indicating potential exfiltration of stolen data.
Referrer headers linking to third-party sites, mail relays, or URL shorteners preceding requests to LOGINFRM_MNG.ASP.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the six vulnerable parameters for HTML metacharacters and common XSS keywords, and blocks or alerts on matches.
Enable server-side request logging with full query string capture, then hunt for anomalous parameter lengths or encoded payloads against LOGINFRM_MNG.ASP.
Correlate proxy logs with endpoint telemetry to identify users who followed suspicious inbound links to the e-TMS host.

Monitoring Recommendations

Forward web server and reverse proxy logs to a centralized analytics platform such as SentinelOne Singularity Data Lake for OCSF-normalized querying and long-term retention.
Monitor endpoint browser telemetry with Singularity Endpoint for post-exploitation behavior such as credential prompts, unexpected script execution, or redirects from the e-TMS origin.
Establish alerting on repeated malformed requests to /clt/LOGINFRM_MNG.ASP, which may indicate reconnaissance or automated exploitation attempts.

How to Mitigate CVE-2025-59768

Immediate Actions Required

Contact AndSoft support to confirm the fixed release for e-TMS and schedule an upgrade from version 25.03.
Restrict access to /clt/LOGINFRM_MNG.ASP by IP allow-listing where operationally feasible until a patch is applied.
Notify e-TMS users of the phishing risk and instruct them not to follow unsolicited links referencing the e-TMS portal.
Rotate credentials for accounts that may have interacted with suspicious login URLs.

Patch Information

AndSoft has been notified through INCIBE-CERT's coordinated disclosure process. No specific fixed version is enumerated in the public NVD record at the time of writing. Consult the INCIBE-CERT advisory and vendor communications for the patched build number.

Workarounds

Configure a WAF rule to reject requests to /clt/LOGINFRM_MNG.ASP containing <, >, ", ', or the keywords script, onerror, onload, javascript: in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Enforce a strict Content-Security-Policy response header that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and Secure flags on all session cookies to reduce the impact of JavaScript-based cookie theft.
Deploy browser isolation or endpoint protection to contain script execution originating from phishing links targeting the e-TMS domain.

bash

# Example ModSecurity rule blocking XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_MNG.ASP" \
    "chain,id:1005901,phase:2,deny,status:403,\
    msg:'CVE-2025-59768 e-TMS reflected XSS attempt'"
    SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
        "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)"