CVE-2025-59772 Overview
CVE-2025-59772 is a reflected cross-site scripting (XSS) vulnerability affecting AndSoft's e-TMS v25.03, a transportation management platform. The flaw exists in the /clt/LOGINFRM_SIL.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input before reflecting it into the HTTP response. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser once the link is opened. The issue is tracked under CWE-79 and was disclosed through INCIBE CERT.
Critical Impact
Successful exploitation lets attackers run JavaScript in an authenticated user's session, enabling credential theft, session hijacking, and unauthorized actions within the e-TMS application.
Affected Products
- AndSoft e-TMS v25.03
- Login endpoint /clt/LOGINFRM_SIL.ASP
- Vulnerable parameters: l, demo, demo2, TNTLOGIN, UO, SuppConn
Discovery Timeline
- 2025-10-02 - CVE-2025-59772 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59772
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in the e-TMS login page. The application accepts multiple query-string parameters and writes their values back into the HTML response without applying output encoding or input validation. Because the payload travels in the URL and is returned by the server in the same request, an attacker only needs a victim to click a crafted link. Exploitation requires user interaction, but no authentication is needed to deliver the payload. The scope of impact extends to any data or actions accessible to the targeted user within the e-TMS session.
Root Cause
The root cause is improper neutralization of input during web page generation, as classified under CWE-79. The LOGINFRM_SIL.ASP handler echoes parameter values directly into the rendered HTML. Without contextual output encoding, injected <script> tags or event-handler attributes execute as part of the page.
Attack Vector
The attack vector is network-based and delivered via a malicious URL. An attacker embeds JavaScript inside one of the affected parameters, hosts or distributes the link through phishing, chat, or a compromised site, and waits for a victim to visit e-TMS. When the browser renders the response, the injected script runs in the origin of the e-TMS application. Attackers can steal session cookies, read page content, submit forged requests, or pivot to other e-TMS functionality authorized for the victim. Refer to the INCIBE CERT advisory for additional technical context.
Detection Methods for CVE-2025-59772
Indicators of Compromise
- Requests to /clt/LOGINFRM_SIL.ASP containing HTML control characters such as <, >, ", or URL-encoded equivalents (%3C, %3E) in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
- Query strings containing keywords like script, onerror, onload, javascript:, or document.cookie.
- Referrers to the login endpoint originating from untrusted external domains or shortened URLs.
Detection Strategies
- Deploy web application firewall (WAF) signatures that inspect query-string parameters on /clt/LOGINFRM_SIL.ASP for XSS payload patterns.
- Enable server-side request logging with full URL capture, and hunt for anomalous parameter lengths or encoded script content.
- Correlate suspicious login-page requests with subsequent authentication events from the same session to identify follow-on account compromise.
Monitoring Recommendations
- Alert on repeated requests to the login endpoint from a single source containing script-related tokens.
- Monitor outbound traffic from user workstations for connections to unknown domains immediately after e-TMS login activity.
- Track browser console errors and Content Security Policy (CSP) violation reports if CSP is enabled.
How to Mitigate CVE-2025-59772
Immediate Actions Required
- Contact AndSoft to confirm the availability of a patched build of e-TMS newer than v25.03 and schedule an upgrade.
- Restrict access to the e-TMS application to trusted networks or VPN clients while a fix is applied.
- Instruct users to avoid clicking e-TMS links received through email, chat, or external sources until the vulnerability is remediated.
Patch Information
No public vendor advisory URL or fixed version is listed in the NVD record at the time of publication. Consult the INCIBE CERT notice for the latest coordinated disclosure information and contact AndSoft directly for a remediated release.
Workarounds
- Deploy WAF rules that block or strip script tags, event handlers, and javascript: URIs in the affected parameters on /clt/LOGINFRM_SIL.ASP.
- Enforce a strict Content Security Policy on the e-TMS application to disallow inline scripts and untrusted script sources.
- Set the HttpOnly and Secure flags on session cookies to limit the impact of script execution in the browser.
- Educate users on phishing awareness and validate the origin of any e-TMS login links before clicking.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
