CVE-2025-59743
📋 TL;DR
A critical SQL injection vulnerability in AndSoft's e-TMS v25.03 allows attackers to manipulate database operations by exploiting the 'SessionID' cookie in connection scripts. This affects all systems running the vulnerable version, potentially exposing sensitive data and system integrity.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, destruction, or ransomware deployment across the entire e-TMS system.
Likely Case
Unauthorized data access and manipulation, potentially exposing sensitive business information and user credentials.
If Mitigated
Limited impact if proper input validation and WAF rules are in place, though risk remains elevated.
🎯 Exploit Status
Exploitation requires only a crafted POST request with malicious SQL in the SessionID cookie.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v25.04 or later
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: Yes
Instructions:
1. Download latest version from AndSoft vendor portal. 2. Backup current installation and database. 3. Install update following vendor documentation. 4. Restart application services.
🔧 Temporary Workarounds
Input Validation Filter
windowsAdd SQL injection filtering for SessionID parameter in CONNECTION.ASP
Modify CONNECTION.ASP to sanitize SessionID input using parameterized queries
WAF Rule Implementation
allBlock SQL injection patterns in SessionID cookies
Configure WAF to detect and block SQL patterns in cookie values
🧯 If You Can't Patch
- Implement network segmentation to isolate e-TMS from critical systems
- Deploy web application firewall with SQL injection detection rules
🔍 How to Verify
Check if Vulnerable:
Test by sending POST request with SQL injection payload in SessionID cookie to /inc/connect/CONNECTION.ASPCheck Version:
Check application version in admin interface or configuration filesVerify Fix Applied:
Verify version is v25.04+ and test SQL injection attempts are properly rejected📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server
- Multiple failed login attempts with SQL patterns
Network Indicators:
- POST requests to CONNECTION.ASP with SQL patterns in cookies
- Unusual database traffic from web server
SIEM Query:
source="web_logs" AND uri="/inc/connect/CONNECTION.ASP" AND cookie="*SELECT*" OR cookie="*UNION*" OR cookie="*INSERT*"