CVE-2025-59773: Andsoft E-tms XSS Vulnerability

CVE-2025-59773 Overview

CVE-2025-59773 is a reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS transportation management software version 25.03. The flaw resides in the /clt/LOGINFRM_TP.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input. Attackers craft malicious URLs that execute arbitrary JavaScript in a victim's browser when the link is opened. Successful exploitation enables session token theft, credential harvesting through injected forms, and unauthorized actions performed under the victim's authenticated context. The vulnerability is tracked under CWE-79 and affects deployments accessible over the network.

Critical Impact
Attackers can execute JavaScript in an authenticated user's browser session by delivering a malicious link, enabling credential theft and account compromise within the e-TMS logistics platform.

Affected Products

AndSoft e-TMS version 25.03
Deployments exposing /clt/LOGINFRM_TP.ASP to untrusted networks
Web clients interacting with the vulnerable login endpoint

Discovery Timeline

2025-10-02 - CVE-2025-59773 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59773

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the login handler /clt/LOGINFRM_TP.ASP of AndSoft e-TMS v25.03. The application reflects query parameter values directly into the HTML response without HTML-entity encoding or contextual output escaping. An attacker who convinces a user to click a specially crafted URL causes the browser to render attacker-controlled markup and execute JavaScript in the origin of the e-TMS application.

Because e-TMS is a Transportation Management System (TMS) used by logistics operators, injected script runs with the privileges of authenticated dispatchers, carriers, or administrative users. This exposes shipment records, freight billing data, and back-office integrations. User interaction is required, which is reflected in the CVSS v4.0 vector (UI:A), but no authentication is needed to craft or deliver the payload. See the INCIBE Security Notice for coordinated disclosure details.

Root Cause

The root cause is missing or insufficient output encoding of six request parameters, l, demo, demo2, TNTLOGIN, UO, and SuppConn, when they are echoed into the login form response. Classic ASP pages that emit request values with <%= Request("param") %> without wrapping the value in Server.HTMLEncode produce this exact class of defect under CWE-79.

Attack Vector

Exploitation follows a standard reflected XSS delivery pattern. The attacker constructs a URL targeting /clt/LOGINFRM_TP.ASP that includes a JavaScript payload inside one of the vulnerable parameters. The link is delivered through phishing email, chat, or embedded in a compromised third-party site. When a logged-in e-TMS user visits the URL, the server reflects the payload into the HTML response and the browser executes it in the application's origin. The script can read session cookies not marked HttpOnly, submit background requests to internal endpoints, or overlay a fake login form to capture credentials.

No verified public exploit code is available. The vulnerability mechanism is described in the INCIBE Security Notice.

Detection Methods for CVE-2025-59773

Indicators of Compromise

HTTP requests to /clt/LOGINFRM_TP.ASP containing <script>, onerror=, onload=, or javascript: substrings in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters
URL-encoded payload markers such as %3Cscript%3E, %3Cimg, or %22onerror%3D targeting the same endpoint
Referrer headers on outbound requests originating from crafted e-TMS URLs delivered via email or chat platforms
Anomalous browser-initiated requests to e-TMS APIs immediately following a user click on an external link

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings on /clt/LOGINFRM_TP.ASP and block payloads containing script tags, event handlers, or encoded equivalents
Enable IIS or reverse-proxy request logging with full query string capture, then hunt for the six vulnerable parameter names paired with HTML control characters
Correlate web server logs with endpoint telemetry to identify users whose browsers issued suspicious cross-origin requests after visiting the login endpoint
Implement Content Security Policy (CSP) violation reporting to surface inline script execution attempts on e-TMS pages

Monitoring Recommendations

Alert on any request to /clt/LOGINFRM_TP.ASP with parameter values exceeding a normal length threshold or containing angle brackets
Track authentication events that follow shortly after clicks on externally sourced e-TMS URLs, indicating possible session replay
Monitor DNS and egress traffic for beaconing domains referenced in XSS payloads targeting e-TMS users

How to Mitigate CVE-2025-59773

Immediate Actions Required

Contact AndSoft support to obtain the fixed release and confirm patch availability for e-TMS v25.03
Restrict network exposure of /clt/LOGINFRM_TP.ASP to trusted networks or VPN segments until a patched version is deployed
Deploy WAF signatures that block XSS payload patterns in the six affected parameters
Rotate active session cookies and force reauthentication for privileged e-TMS accounts

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry for CVE-2025-59773. Coordinated disclosure was handled by INCIBE-CERT. Refer to the INCIBE Security Notice and contact AndSoft directly to confirm the fixed build for e-TMS.

Workarounds

Configure the reverse proxy or WAF to reject requests to /clt/LOGINFRM_TP.ASP where l, demo, demo2, TNTLOGIN, UO, or SuppConn contain <, >, ", ', or their URL-encoded forms
Set the HttpOnly and Secure flags on all e-TMS session cookies to reduce impact of injected script
Enforce a strict Content Security Policy that disallows inline script and restricts script sources to the application origin
Train dispatchers and administrative users to avoid clicking e-TMS links received from untrusted sources

bash

# Example ModSecurity rule blocking reflected XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /clt/LOGINFRM_TP.ASP" \
    "phase:2,chain,deny,status:403,log,msg:'CVE-2025-59773 XSS attempt'"
    SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
        "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)"