CVE-2025-59750
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03 allows attackers to execute malicious JavaScript in victims' browsers by tricking them into clicking specially crafted URLs. The vulnerability affects users of the e-TMS web interface who access malicious links containing payloads in specific parameters. Attackers can steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full system access, compromise sensitive data, and potentially pivot to internal networks.
Likely Case
Attackers steal user session cookies to impersonate legitimate users, access their data, and perform unauthorized actions within the application.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution, preventing successful exploitation.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly weaponized in phishing campaigns. No authentication required to craft malicious URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for patched version
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: Yes
Instructions:
1. Review vendor advisory for patched version. 2. Backup current installation. 3. Apply vendor-provided patch or upgrade to fixed version. 4. Restart application services. 5. Test functionality.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block XSS payloads in URL parameters
Input Validation Filter
windowsImplement server-side validation for 'l, demo, demo2, TNTLOGIN, UO, SuppConn' parameters
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Deploy network segmentation to isolate vulnerable system from critical assets
🔍 How to Verify
Check if Vulnerable:
Test by injecting XSS payloads into 'l, demo, demo2, TNTLOGIN, UO, SuppConn' parameters in /clt/LOGINFRM.ASP URLsCheck Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Retest XSS payloads after patch; verify they are properly encoded or rejected📡 Detection & Monitoring
Log Indicators:
- Unusual long parameter values in /clt/LOGINFRM.ASP requests
- JavaScript patterns in URL parameters
- Multiple failed login attempts from same IP
Network Indicators:
- HTTP requests with script tags in URL parameters
- Unusual redirects from login page
SIEM Query:
source="web_server" AND uri_path="/clt/LOGINFRM.ASP" AND (param="l" OR param="demo" OR param="demo2" OR param="TNTLOGIN" OR param="UO" OR param="SuppConn") AND (value CONTAINS "<script>" OR value CONTAINS "javascript:")