CVE-2025-59767
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS allows attackers to inject malicious JavaScript via specially crafted URLs containing the 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters. When victims click these malicious links, the attacker can execute arbitrary code in their browser session. Organizations using AndSoft e-TMS v25.03 are affected.
💻 Affected Systems
- AndSoft e-TMS
📦 What is this software?
E Tms by Andsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on victim systems.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected content.
If Mitigated
Limited impact if input validation and output encoding are properly implemented, though some user interface manipulation may still occur.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly exploited with simple malicious URLs that don't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
Restart Required: No
Instructions:
1. Monitor AndSoft for security updates. 2. Apply any available patches immediately. 3. Test in non-production environment first.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block malicious XSS payloads targeting the vulnerable parameters.
# WAF-specific rules vary by vendor
Input Validation Filter
windowsAdd server-side validation to sanitize the vulnerable parameters before processing.
# Implementation depends on ASP application code
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Deploy network segmentation to limit access to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Test by injecting harmless payloads like <script>alert('test')</script> into the vulnerable parameters via URL.Check Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Retest with the same payloads after applying fixes; successful fix should show encoded output, not executed scripts.📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values containing script tags or JavaScript in access logs
- Multiple failed login attempts with malicious payloads
Network Indicators:
- HTTP requests with suspicious parameters containing script tags or encoded payloads
SIEM Query:
web.url:*LOGINFRM_LVE.ASP* AND (web.param:*<script* OR web.param:*javascript:* OR web.param:*onerror=*)