AndSoft e-TMS Command Injection Vulnerability

A command injection vulnerability allowing the execution of operating system commands on the server has been identified in AndSoft's e-TMS version 25.03. This vulnerability arises from the 'm' parameter in the '/clt/LOGINFRM_BET.ASP' endpoint, where an attacker can send a POST request to execute arbitrary commands.

Impact

Exploitation of this vulnerability allows for operating system command injection, enabling attackers to execute commands on the server where the application is hosted.

Remediation

Users can upgrade to AndSoft e-TMS versions VNL 25001 or VNL 25010, both released in January 2025, to address this vulnerability. As of version 25.04, the vulnerability has been completely fixed.