CVE-2025-59769: Andsoft E-tms XSS Vulnerability

CVE-2025-59769 Overview

CVE-2025-59769 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03 transportation management platform. The flaw resides in the /clt/LOGINFRM_MOL.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to properly sanitize user-controlled input. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser upon interaction. The vulnerability maps to CWE-79 and requires user interaction to trigger.

Critical Impact
Successful exploitation enables session hijacking, credential theft through injected login forms, and unauthorized actions performed in the context of an authenticated e-TMS user.

Affected Products

AndSoft e-TMS v25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03:*:*:*:*:*:*:*
Affected endpoint: /clt/LOGINFRM_MOL.ASP

Discovery Timeline

2025-10-02 - CVE-2025-59769 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59769

Vulnerability Analysis

The vulnerability exists in the login form module of AndSoft e-TMS, a transportation management system used in logistics operations. The /clt/LOGINFRM_MOL.ASP script reflects the values of six query string parameters (l, demo, demo2, TNTLOGIN, UO, and SuppConn) into the HTML response without applying output encoding or input validation. An attacker who sends a victim a crafted URL can inject script content that executes when the page renders in the victim's browser.

Because the attack targets the login page, threat actors can inject fake credential prompts or JavaScript that captures form input before submission. The reflected nature of the flaw means the payload does not persist on the server but requires social engineering to deliver the malicious link. Spanish CERT INCIBE published a coordinated advisory covering this and related e-TMS issues.

Root Cause

The root cause is missing input sanitization and output encoding when the ASP handler embeds request parameters into the rendered HTML. Standard XSS defenses such as HTML entity encoding and Content Security Policy headers are absent from the affected page.

Attack Vector

Exploitation requires the attacker to deliver a crafted URL to a victim through phishing, chat, or third-party sites. When the victim opens the link, the injected JavaScript runs in the origin of the vulnerable e-TMS deployment. No authentication is required to construct or send the payload, but the victim must click the link for the attack to succeed.

A representative attack URL follows the pattern https://<target>/clt/LOGINFRM_MOL.ASP?l=<script-payload> where the payload closes the reflecting HTML context and injects attacker-controlled script. See the INCIBE Security Notice on Vulnerabilities for coordinated advisory details.

Detection Methods for CVE-2025-59769

Indicators of Compromise

Web server access logs containing requests to /clt/LOGINFRM_MOL.ASP with suspicious query parameters that include <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers pointing to external domains before requests to the login endpoint, suggesting phishing delivery.
Unusual outbound requests from authenticated user sessions to attacker-controlled domains following visits to the login page.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters for HTML tags, event handlers, and script scheme URIs.
Correlate web proxy logs with endpoint telemetry to identify browsers that render script content originating from the e-TMS login page.
Hunt for anomalous session cookie exfiltration patterns tied to user activity on /clt/LOGINFRM_MOL.ASP.

Monitoring Recommendations

Enable verbose IIS logging for the /clt/ directory and forward logs to a centralized SIEM for query-parameter inspection.
Alert on any 200-response requests to LOGINFRM_MOL.ASP where query strings exceed a reasonable length threshold.
Monitor phishing intelligence feeds for domains impersonating customer e-TMS instances.

How to Mitigate CVE-2025-59769

Immediate Actions Required

Contact AndSoft to obtain the patched release addressing the reflected XSS in LOGINFRM_MOL.ASP and schedule urgent deployment.
Deploy WAF signatures that block XSS payloads targeting the six vulnerable parameters until the patch is applied.
Educate users about phishing links referencing the e-TMS login page and enforce URL inspection at the mail gateway.

Patch Information

AndSoft has not published a public patch reference in the NVD entry. Customers should consult the INCIBE Security Notice on Vulnerabilities and contact AndSoft directly for fixed builds beyond v25.03.

Workarounds

Configure the web server to strip or reject requests containing HTML metacharacters in the affected query parameters.
Add a strict Content Security Policy (CSP) header on the login page to block inline script execution, for example Content-Security-Policy: default-src 'self'; script-src 'self'.
Restrict access to the e-TMS portal to trusted IP ranges or VPN users to reduce phishing exposure.

bash

# Example ModSecurity rule blocking script injection in vulnerable parameters
SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
    "@rx (?i)(<script|javascript:|onerror=|onload=|<svg|<img[^>]+src)" \
    "id:1005976,phase:2,deny,status:403,\
    msg:'CVE-2025-59769 e-TMS reflected XSS attempt blocked',\
    logdata:'Matched param: %{MATCHED_VAR_NAME} Value: %{MATCHED_VAR}'"