CVE-2025-59751
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03 allows attackers to inject malicious JavaScript via specially crafted URLs containing the 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters. When victims click these links, the attacker can execute arbitrary code in their browser session. Organizations using the vulnerable e-TMS version are affected.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on victim systems.
Likely Case
Session hijacking, credential theft, and unauthorized actions within the e-TMS application using stolen authentication tokens.
If Mitigated
Limited impact if proper input validation, output encoding, and Content Security Policy are implemented.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link) but has low technical complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: No
Instructions:
1. Contact AndSoft vendor for patch availability. 2. Apply vendor-provided security update. 3. Test in non-production environment first.
🔧 Temporary Workarounds
Input Validation Filter
windowsImplement server-side input validation for the vulnerable parameters to reject malicious payloads.
[ASP code implementation required - no universal command]
Web Application Firewall (WAF)
allDeploy WAF rules to block XSS payloads targeting the vulnerable endpoint.
[WAF-specific configuration required]
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Deploy network segmentation to limit access to vulnerable system
🔍 How to Verify
Check if Vulnerable:
Test by sending XSS payloads to '/clt/LOGINFRM_DJO.ASP' with vulnerable parameters and checking if they execute.Check Version:
Check application version in interface or configuration filesVerify Fix Applied:
Retest with same XSS payloads after remediation; payloads should be sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in '/clt/LOGINFRM_DJO.ASP' requests
- JavaScript patterns in URL parameters
Network Indicators:
- HTTP requests containing script tags or JavaScript in vulnerable parameters
SIEM Query:
web.url:*LOGINFRM_DJO.ASP* AND (web.param:*<script* OR web.param:*javascript:* OR web.param:*onerror=*)