CVE-2025-59742
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
SQL injection vulnerability in AndSoft's e-TMS v25.03. It exists in the 'USRMAIL' parameter in '/inc/login/TRACK_REQUESTFRMSQL.ASP' and allows an attacker to retrieve, create, update, and delete databases by sending a POST request.
Risk Assessment
An attacker could gain full access to the database, including stealing, modifying, or deleting authentication and business data. This may lead to account takeover and loss of data integrity.
Recommendation
Update e-TMS to the vendor-patched version as soon as possible and enforce input validation and parameterized SQL queries. Until patched, restrict access to the login interface from untrusted networks.
Other vulnerabilities in AndSoft e-TMS
See all- CVE-2025-59743Critical
AndSoft e-TMS v25.03 is vulnerable to SQL injection in /inc/connect/CONNECTION.ASP via the 'SessionID' cookie. An attacker can send a POST request to retrieve, create, update, and delete database data.
- CVE-2025-59741Critical
An operating system command injection vulnerability exists in AndSoft's e-TMS v25.03.03. An attacker can execute arbitrary OS commands on the server by sending a crafted POST request with the 'm' parameter to '/CLT/LOGINERRORFRM.ASP'.
- CVE-2025-59740Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_CAT.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59739Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_original.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59738Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_BET.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59737Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_LXA.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59736Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_DJO.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59735Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59774Medium
AndSoft e-TMS v25.03 contains a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can execute JavaScript code in the victim's browser by sending a malicious URL with parameters 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in the path '/clt/LOGINFRM_VON.ASP'.
- CVE-2025-59773Medium
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_TP.ASP'.
Original NVD description (English source)
SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter in'/inc/login/TRACK_REQUESTFRMSQL.ASP'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS