AndSoft e-TMS SQL Injection Vulnerability

A SQL injection vulnerability exists in AndSoft's e-TMS version 25.03. This vulnerability allows attackers to retrieve, create, update, and delete database entries by sending a POST request. The vulnerability is linked to the 'USRMAIL' parameter in the '/inc/login/TRACK_REQUESTFRMSQL.ASP' file.

Impact

Exploitation of this vulnerability could lead to unauthorized database manipulation, allowing attackers to alter, delete, or extract sensitive information from the database.

Remediation

Users can upgrade to AndSoft e-TMS versions VNL 25001 or VNL 25010, or version 25.04, where this vulnerability has been fixed.