AndSoft e-TMS Command Injection Vulnerability

A command injection vulnerability allowing the execution of operating system commands on the server has been identified in AndSoft's e-TMS version 25.03. This vulnerability arises from improper handling of the 'm' parameter in the '/clt/LOGINFRM_original.ASP' endpoint, enabling attackers to send POST requests that execute arbitrary commands on the server.

Impact

Exploitation of this vulnerability allows for operating system command injection, where an attacker can execute commands on the server with the same privileges as the application user.

Remediation

Users can upgrade to AndSoft e-TMS versions VNL 25001 or VNL 25010, or version 25.04, where this vulnerability has been fixed.