CVE-2025-59742: Critical SQL Injection in AndSoft e-TMS

CVE-2025-59742 is a critical (CVSS 9.8) SQL injection in AndSoft e-TMS 25.03. The USRMAIL parameter in /inc/login/TRACK_REQUESTFRMSQL.ASP can let an attacker retrieve, create, update and delete databases. No fixed version is confirmed, so restrict access and contact AndSoft. The sections below cover who is affected, how to check, and what to do now.

What's affected

The record names AndSoft's e-TMS version 25.03 as affected. The source cited is a Spanish national CSIRT notice from INCIBE titled as an update of 24 September 2025 covering multiple vulnerabilities in AndSoft's e-TMS.

I could not load the INCIBE page from the command line, so I cannot confirm a fixed version. Check the INCIBE notice and ask AndSoft which release resolves it.

The affected file is /inc/login/TRACK_REQUESTFRMSQL.ASP, and the input is the USRMAIL parameter. This is one of nine closely related CVEs, CVE-2025-59735 to CVE-2025-59743, all published for e-TMS 25.03. Seven are command injection and two, including this one, are SQL injection.

How to check if you're exposed

Confirm whether you run e-TMS and which release. It is a transport management web application, so look for the ASP pages named in the record on your web server and in your reverse proxy logs.

grep -i "track_requestfrmsql.asp" /var/log/nginx/access.log | head

Adjust the log path for your server. Look for requests to that page from addresses you do not expect, and for unexpected child processes on the web host.

What to do now

1. Confirm the e-TMS version you run. The record names 25.03.
2. Read the INCIBE notice and contact AndSoft for the fixed release.
3. Restrict access to the application, ideally putting the login pages behind a VPN or an allow list.
4. Place a web application firewall rule or reverse proxy restriction in front of the affected page while you wait.
5. Review web and database server logs and account activity for anything unusual.
6. Use a database account for e-TMS with the least privilege that still works, so the application cannot drop or alter structures it does not own.

Why it matters

The record maps this to CWE-89, SQL injection. The USRMAIL parameter is placed into a database query unsafely. The record describes the impact as being able to retrieve, create, update and delete databases, and the vector confirms high impact on confidentiality, integrity and availability with no privileges needed.

Cookies are a notable place for this bug, since developers rarely think of them as user input. Anything the browser sends, including headers and cookies, is controlled by the client and must be treated the same as a form field. It is not on the CISA KEV list, and the record has no exploitation information.

SQL injection happens when input reaches a database query as part of its structure instead of as plain data. The reliable defence is the same everywhere: parameterised queries or prepared statements, and no string building for anything a user can influence. Input validation helps, but it is a second line, not the first.

If you find injectable code in your own applications, treat the fix as two jobs. Change the query so the value is bound as a parameter, and check the database account the application uses. An account that can only read the tables it needs turns a bad bug into a smaller one.

Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.

Quick check

Sources

• INCIBE CERT notice on AndSoft e-TMS (listed in the record, page did not load for me)
• NVD record data

Last reviewed: 18 October 2026.