CVE-2025-59749
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03 allows attackers to inject malicious JavaScript via the 'l' parameter in the TRACK_REQUEST.ASP endpoint. When victims click a specially crafted URL, the attacker can execute arbitrary code in their browser session. Organizations using the vulnerable e-TMS version are affected.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on client systems.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected content.
If Mitigated
Limited impact if proper input validation, output encoding, and Content Security Policy are implemented.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link). No authentication needed to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: No
Instructions:
1. Contact AndSoft for patch information. 2. Apply vendor-provided update when available. 3. Test in non-production environment first.
🔧 Temporary Workarounds
Input Validation Filter
windowsImplement server-side validation to sanitize the 'l' parameter
Add input validation in TRACK_REQUEST.ASP for 'l' parameter
Web Application Firewall Rule
allBlock malicious requests containing XSS payloads in the 'l' parameter
Configure WAF to filter requests with script tags or JavaScript in URL parameters
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Deploy web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Test by accessing /clt/TRACK_REQUEST.ASP?l=<script>alert('XSS')</script> and checking if script executesCheck Version:
Check application version in interface or configuration filesVerify Fix Applied:
Retest with XSS payloads after applying fixes to confirm they're properly sanitized📡 Detection & Monitoring
Log Indicators:
- HTTP requests to TRACK_REQUEST.ASP with suspicious 'l' parameter values containing script tags or JavaScript
Network Indicators:
- Unusual traffic patterns to the vulnerable endpoint with encoded payloads
SIEM Query:
source="web_logs" AND uri="/clt/TRACK_REQUEST.ASP" AND (query CONTAINS "<script>" OR query CONTAINS "javascript:")