CVE-2025-59745
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to collision attacks and can be easily cracked with modern hardware, exposing user credentials to potential risks.
Risk Assessment
User passwords can be cracked, leading to unauthorized access to accounts and systems. This may result in data breaches and compromise of organizational security.
Recommendation
Update the software to a version that uses a secure hashing algorithm (e.g., bcrypt, Argon2). Enforce password changes for all users.
Other vulnerabilities in AndSoft e-TMS
See all- CVE-2025-59743Critical
AndSoft e-TMS v25.03 is vulnerable to SQL injection in /inc/connect/CONNECTION.ASP via the 'SessionID' cookie. An attacker can send a POST request to retrieve, create, update, and delete database data.
- CVE-2025-59742Critical
SQL injection vulnerability in AndSoft's e-TMS v25.03. It exists in the 'USRMAIL' parameter in '/inc/login/TRACK_REQUESTFRMSQL.ASP' and allows an attacker to retrieve, create, update, and delete databases by sending a POST request.
- CVE-2025-59741Critical
An operating system command injection vulnerability exists in AndSoft's e-TMS v25.03.03. An attacker can execute arbitrary OS commands on the server by sending a crafted POST request with the 'm' parameter to '/CLT/LOGINERRORFRM.ASP'.
- CVE-2025-59740Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_CAT.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59739Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_original.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59738Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_BET.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59737Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_LXA.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59736Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_DJO.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59735Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59774Medium
AndSoft e-TMS v25.03 contains a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can execute JavaScript code in the victim's browser by sending a malicious URL with parameters 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in the path '/clt/LOGINFRM_VON.ASP'.
Original NVD description (English source)
Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to collision attacks and can be easily cracked with modern hardware, exposing user credentials to potential risks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS