External risk intelligence

AndSoft e-TMS SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-59743

The vulnerability resides in a web application (e-TMS) and is exploitable via a POST request to an ASP-based connection file. As a web-based transport management system, such applications are commonly deployed as internet-facing portals or services to facilitate remote access for users and partners, making them a likely target for external exposure.

SQL Injection

Andsoft E Tms

25.03

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been identified in AndSoft's e-TMS software. This issue could allow an unauthorized party to manipulate databases by sending a specific request. The main concern is confirming if our organization uses this affected software and is therefore exposed.

Software allows database access by attackers.
Important for potential data integrity and access risks.
Confirm if e-TMS is in use within our environment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted POST request to the vulnerable component. This request targets a specific parameter associated with a session identifier, potentially allowing unauthorized access to the system's database. If successful, an attacker could then manipulate the database by retrieving, creating, updating, or deleting information.

Requires network access, no authentication.
Triggered by sending a POST request.
Allows full database manipulation.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability could allow an unauthenticated attacker to compromise database integrity and confidentiality by sending a specially crafted POST request. When supported, this could lead to unauthorized access and modification of sensitive information stored within the e-TMS system.

Database integrity and confidentiality.
Via a malicious POST request.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this SQL injection vulnerability in e-TMS. The first practical step involves identifying all instances of the affected technology, confirming its accessibility and criticality, and then assigning ownership for remediation planning.

Confirm application and infrastructure ownership.
Verify system reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AndSoft e-TMS?

AndSoft e-TMS is a specialized transport management system designed to help logistics companies coordinate shipping, fleet operations, and supply chain workflows. It acts as a central digital hub for managing complex transportation data, often serving as a bridge between internal operational teams and external partners or clients who need to track shipments and cargo status.

How does SQL injection work in CVE-2025-59743?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. It means the software does not properly filter user-supplied input before using it in a database query. In this specific case, an attacker can manipulate the underlying database commands by injecting malicious code into a 'SessionID' cookie, effectively tricking the system into executing unauthorized database operations.

When is this SQL injection triggered?

The vulnerability is triggered when an attacker sends a specifically crafted POST request to the '/inc/connect/CONNECTION.ASP' file on the server. Simply browsing the site or sending standard GET requests does not initiate the attack path. The system must process the malicious 'SessionID' cookie value during a POST operation for the flaw to be exploited.

Is my organization at risk from this?

According to Halo Surface Signal, this vulnerability is highly likely to affect organizations that deploy e-TMS as an internet-facing portal. Because the service is often exposed to the web to allow remote access for partners and remote staff, it is frequently reachable by unauthorized external actors. Systems restricted entirely to internal networks are generally at lower risk.

How should I respond to CVE-2025-59743?

Your first step is to perform an inventory of your environment to identify any servers running AndSoft e-TMS version 25.03. Once located, assess whether these instances are accessible from the internet. Engage the application owners to document the system's business criticality and verify if formal patching or configuration changes are available from the vendor to secure the connection handler.

References

www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.