CVE-2025-59758
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS allows attackers to inject malicious JavaScript via specially crafted URLs containing certain parameters. When victims click these malicious links, the attacker can execute arbitrary code in their browser sessions. This affects all users of the vulnerable e-TMS web application.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on client systems.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected content.
If Mitigated
Limited impact if proper input validation, output encoding, and Content Security Policy are implemented.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link) but is straightforward to exploit once the vulnerable parameters are identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: No
Instructions:
1. Contact AndSoft for patch availability. 2. Apply vendor-provided security update. 3. Test the fix in a non-production environment first.
🔧 Temporary Workarounds
Implement Input Validation and Output Encoding
windowsAdd server-side validation and proper encoding for all user-supplied input in the affected ASP page.
Deploy Web Application Firewall (WAF)
allConfigure WAF rules to block XSS payloads targeting the vulnerable parameters.
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Monitor and filter malicious requests containing XSS payloads in the affected parameters
🔍 How to Verify
Check if Vulnerable:
Test by sending XSS payloads to the /clt/LOGINFRM_CYLOG.ASP endpoint with parameters l, demo, demo2, TNTLOGIN, UO, or SuppConn.Check Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Retest with the same XSS payloads after applying fixes; payloads should be properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing script tags or JavaScript in the vulnerable parameters
- Unusual parameter values in login form requests
Network Indicators:
- URLs containing encoded JavaScript payloads in query parameters
- Requests to the vulnerable ASP page with suspicious parameter values
SIEM Query:
source="web_server" AND uri="/clt/LOGINFRM_CYLOG.ASP" AND (query="*<script*" OR query="*javascript:*" OR query="*onerror=*" OR query="*onload=*")