CVE-2025-59774: Andsoft E-tms XSS Vulnerability

CVE-2025-59774 Overview

CVE-2025-59774 is a reflected Cross-Site Scripting (XSS) vulnerability in AndSoft's e-TMS v25.03 transportation management system. The flaw resides in the /clt/LOGINFRM_VON.ASP endpoint, where the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters fail to sanitize user-supplied input. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when clicked. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions within the e-TMS application.

Affected Products

AndSoft e-TMS v25.03
CPE: cpe:2.3:a:andsoft:e-tms:25.03
Deployments exposing /clt/LOGINFRM_VON.ASP to untrusted networks

Discovery Timeline

2025-10-02 - CVE-2025-59774 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59774

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the login form handler at /clt/LOGINFRM_VON.ASP. The ASP page reflects six query-string parameters, l, demo, demo2, TNTLOGIN, UO, and SuppConn, directly into the HTML response. Because the application does not encode or sanitize these values, attacker-controlled markup is rendered as executable content by the browser.

Exploitation requires the victim to click a crafted link, matching the User Interaction requirement (UI:A) in the CVSS 4.0 vector. Successful execution allows the attacker to run arbitrary JavaScript in the security context of the e-TMS application origin. This enables theft of session cookies, keystroke capture on the login form, and forced actions against the e-TMS backend if the victim is authenticated.

e-TMS is a transportation management platform used to coordinate logistics operations, so injected scripts could expose shipment data, carrier credentials, or client portal sessions. INCIBE-CERT published a coordinated advisory covering multiple e-TMS vulnerabilities, including this one.

Root Cause

The root cause is missing output encoding on parameters reflected by the classic ASP page. The application accepts query parameters and writes them into the HTML response body or attributes without HTML-entity encoding or contextual escaping. This is a textbook [CWE-79] pattern in legacy ASP applications that concatenate Request.QueryString values into Response.Write output.

Attack Vector

The attack is delivered over the network with no privileges required. An attacker crafts a URL targeting /clt/LOGINFRM_VON.ASP with a JavaScript payload embedded in one of the vulnerable parameters, then delivers the link through phishing, chat, or a compromised referrer. When the victim loads the URL, the injected script executes within the e-TMS origin. Refer to the INCIBE Security Notice for coordinated disclosure details.

Detection Methods for CVE-2025-59774

Indicators of Compromise

HTTP GET requests to /clt/LOGINFRM_VON.ASP containing <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E) in the l, demo, demo2, TNTLOGIN, UO, or SuppConn parameters.
Unusually long query strings or parameter values exceeding normal login-form lengths on the e-TMS host.
Referrer headers pointing to external phishing domains preceding requests to the login page.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that block reflected XSS payloads on the vulnerable ASP endpoint and its query parameters.
Review web server access logs (IIS u_ex*.log) for suspicious parameter values on LOGINFRM_VON.ASP.
Correlate outbound requests from user browsers to unknown domains immediately after a click on an e-TMS URL, which may indicate cookie exfiltration.

Monitoring Recommendations

Alert on any anomalous HTML control characters (<, >, ", ') appearing in query parameters for the e-TMS login endpoint.
Monitor authenticated e-TMS sessions for concurrent logins from disparate geographies, which may indicate session-token theft.
Track user-reported phishing emails referencing e-TMS URLs and pivot on the linked parameters.

How to Mitigate CVE-2025-59774

Immediate Actions Required

Contact AndSoft to obtain the fixed release of e-TMS and schedule an upgrade from v25.03.
Restrict access to /clt/LOGINFRM_VON.ASP at the perimeter until patched, allowing only trusted client networks where feasible.
Deploy WAF signatures that reject HTML metacharacters in the l, demo, demo2, TNTLOGIN, UO, and SuppConn parameters.
Educate users to avoid clicking unsolicited e-TMS login URLs and to verify links before authenticating.

Patch Information

AndSoft has not published a public patch reference in the NVD entry at the time of writing. Consult the INCIBE Security Notice and coordinate directly with AndSoft support to obtain a fixed build. Verify remediation by testing the affected parameters with benign markup after upgrading.

Workarounds

Enable a strict Content Security Policy (CSP) that disallows inline scripts on the e-TMS application to blunt reflected XSS execution.
Configure session cookies with HttpOnly and SameSite=Strict attributes so cookies cannot be read by injected JavaScript or sent via cross-site requests.
Place the e-TMS login page behind a reverse proxy that strips or encodes suspicious query parameters before forwarding to the ASP application.
Implement URL filtering at the email gateway to detect and block crafted links targeting LOGINFRM_VON.ASP with script payloads.

bash

# Example WAF rule (ModSecurity) to block XSS payloads on vulnerable parameters
SecRule REQUEST_URI "@contains /clt/LOGINFRM_VON.ASP" \
    "chain,phase:2,deny,status:403,id:1005974,\
    msg:'CVE-2025-59774 e-TMS reflected XSS attempt'"
  SecRule ARGS:l|ARGS:demo|ARGS:demo2|ARGS:TNTLOGIN|ARGS:UO|ARGS:SuppConn \
    "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)"