CVE-2025-59752
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS allows attackers to inject malicious JavaScript via specially crafted URLs. When victims click these links, the attacker can steal session cookies, redirect users, or perform actions on their behalf. Organizations using e-TMS v25.03 with internet-facing login pages are primarily affected.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full system access, compromise sensitive data, and pivot to internal networks.
Likely Case
Session hijacking leading to unauthorized access, data theft, or defacement of the application interface.
If Mitigated
Limited to minor data leakage or temporary disruption if proper input validation and output encoding are implemented.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link) but is trivial to craft once parameter details are known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: No
Instructions:
1. Contact AndSoft vendor for security updates. 2. Apply any available patches for e-TMS v25.03. 3. Test in staging environment before production deployment.
🔧 Temporary Workarounds
Input Validation Filter
windowsImplement server-side validation to sanitize 'l, demo, demo2, TNTLOGIN, UO, SuppConn' parameters in login forms.
ASP code modifications required - no single command
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block XSS payloads targeting the vulnerable parameters.
WAF-specific configuration required
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Disable external access to '/clt/LOGINFRM_LXA.ASP' via network controls
🔍 How to Verify
Check if Vulnerable:
Test by injecting XSS payloads into the vulnerable parameters and checking if scripts execute in browser responses.Check Version:
Check application interface or configuration files for e-TMS version informationVerify Fix Applied:
Re-test with XSS payloads after fixes; scripts should be properly encoded or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in '/clt/LOGINFRM_LXA.ASP' requests containing script tags or JavaScript
Network Indicators:
- HTTP requests with XSS patterns in query parameters
SIEM Query:
source="web_server" AND uri="/clt/LOGINFRM_LXA.ASP" AND (query CONTAINS "<script>" OR query CONTAINS "javascript:")