CVE-2025-59755
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03 allows attackers to execute malicious JavaScript in victims' browsers by tricking them into visiting specially crafted URLs. The vulnerability affects users of the e-TMS web interface who click on malicious links containing payloads in specific parameters.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on client systems.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected content.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though some client-side risks remain.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly exploited with simple malicious URLs that don't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: No
Instructions:
1. Monitor AndSoft vendor website for security updates. 2. Apply any available patches for e-TMS v25.03. 3. Test in non-production environment before deployment.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block XSS payloads in URL parameters
Input Validation Filter
windowsImplement server-side input validation for the vulnerable parameters
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Deploy network segmentation to limit access to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Test by accessing /clt/LOGINFRM_CAT.ASP with XSS payloads in l, demo, demo2, TNTLOGIN, UO, or SuppConn parametersCheck Version:
Check e-TMS version in application interface or configuration filesVerify Fix Applied:
Verify that XSS payloads in vulnerable parameters are properly sanitized or blocked📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in /clt/LOGINFRM_CAT.ASP requests
- JavaScript patterns in URL parameters
Network Indicators:
- HTTP requests with suspicious script tags or JavaScript in query parameters
SIEM Query:
source="web_server" AND uri="/clt/LOGINFRM_CAT.ASP" AND (query CONTAINS "<script>" OR query CONTAINS "javascript:")