CVE-2025-59771: Andsoft E-tms XSS Vulnerability

CVE-2025-59771 Overview

CVE-2025-59771 is a reflected cross-site scripting (XSS) vulnerability affecting AndSoft's e-TMS (Transportation Management System) version 25.03. The flaw resides in the /clt/LOGINFRM_MRK.ASP endpoint, where multiple request parameters are reflected in the server response without proper output encoding. Attackers can craft a malicious URL that executes arbitrary JavaScript in the victim's browser once the link is opened. The affected parameters are l, demo, demo2, TNTLOGIN, UO, and SuppConn. The weakness is tracked under [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows execution of attacker-controlled JavaScript in a victim's browser session, enabling credential theft, session hijacking, and phishing against users of AndSoft's e-TMS logistics platform.

Affected Products

AndSoft e-TMS 25.03
Component: /clt/LOGINFRM_MRK.ASP login page
Vulnerable parameters: l, demo, demo2, TNTLOGIN, UO, SuppConn

Discovery Timeline

2025-10-02 - CVE-2025-59771 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59771

Vulnerability Analysis

The vulnerability is a classic reflected XSS in the marketing login form of AndSoft's e-TMS v25.03. The ASP page /clt/LOGINFRM_MRK.ASP accepts several query string parameters and echoes their values back into the HTML response without sanitization or context-aware encoding. An attacker who convinces an authenticated or unauthenticated user to click a crafted link causes the injected payload to execute in the browser under the origin of the e-TMS application.

Because e-TMS is a Transportation Management System used by logistics operators, exploitation can expose session cookies, stored credentials, shipment data, and API tokens accessible from the victim's browser. The Spanish national CSIRT INCIBE-CERT tracks this issue as one of several vulnerabilities in the product. See the INCIBE CERT Security Notice for the vendor-coordinated advisory.

Root Cause

The root cause is missing output encoding on user-controlled query parameters rendered into the HTML body of the login page. The application trusts client-supplied values for l, demo, demo2, TNTLOGIN, UO, and SuppConn and writes them directly into the response. No input validation or HTML entity encoding is applied before reflection.

Attack Vector

Exploitation requires the attacker to deliver a malicious URL to a target user, typically via phishing email, chat, or an attacker-controlled web page. When the victim clicks the link, the browser sends the crafted parameters to /clt/LOGINFRM_MRK.ASP, which reflects the payload. The victim's browser then parses the returned HTML and executes the injected JavaScript in the context of the e-TMS domain. User interaction is required, but no authentication or privileges are needed on the attacker's side.

An illustrative request pattern targets one of the vulnerable parameters, for example: https://<e-tms-host>/clt/LOGINFRM_MRK.ASP?l=<script-payload>. The payload executes with access to the DOM, cookies not marked HttpOnly, and any tokens present in the page.

Detection Methods for CVE-2025-59771

Indicators of Compromise

Web server access logs containing requests to /clt/LOGINFRM_MRK.ASP with HTML or JavaScript characters (<, >, %3C, %3E, script, onerror, onload) in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Unusual referrers from external phishing domains pointing to the e-TMS login endpoint.
Spikes in failed login attempts or session anomalies immediately following user clicks on external links.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that blocks or alerts on script tags, event handlers, and encoded XSS patterns in requests to /clt/LOGINFRM_MRK.ASP.
Correlate browser-side Content Security Policy (CSP) violation reports with the e-TMS origin to surface injection attempts.
Ingest web server and proxy logs into a centralized analytics platform and hunt for reflective parameter values matching known XSS signatures.

Monitoring Recommendations

Continuously monitor HTTP requests to the AndSoft e-TMS application for anomalous parameter content and long URL lengths.
Track outbound requests from user endpoints to newly registered or low-reputation domains that reference the e-TMS host as a target.
Alert on session cookies being transmitted to unexpected destinations, which may indicate successful token exfiltration.

How to Mitigate CVE-2025-59771

Immediate Actions Required

Apply the vendor fix distributed by AndSoft as coordinated through INCIBE-CERT for e-TMS v25.03. Refer to the INCIBE CERT Security Notice for current patch guidance.
Restrict external access to /clt/LOGINFRM_MRK.ASP where feasible, limiting the endpoint to trusted networks until patched.
Educate users of the e-TMS platform to avoid clicking untrusted URLs referencing the login page.

Patch Information

AndSoft has coordinated remediation with INCIBE-CERT. Administrators should contact AndSoft support and consult the INCIBE CERT Security Notice to obtain the fixed release addressing CVE-2025-59771 and the other vulnerabilities disclosed in the same advisory.

Workarounds

Deploy WAF rules that block requests containing HTML-encoded or literal script payloads in the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters of /clt/LOGINFRM_MRK.ASP.
Set the HttpOnly and Secure flags on all session cookies to reduce impact of successful script execution.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Add server-side HTML entity encoding to any custom templates or extensions that reflect query parameters back into responses.

bash

# Example ModSecurity rule blocking XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /clt/LOGINFRM_MRK.ASP" \
  "chain,phase:2,deny,status:403,id:1005977,\
   msg:'Potential XSS attempt against AndSoft e-TMS (CVE-2025-59771)'"
SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
  "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)"