AhnLab EPP Management NoSQL Injection Vulnerability (CVE-2025-60357) with POC

Vulnerability Overview Vulnerability Name: CVE-2025-60357 - NoSQL (MongoDB) Injection Description: A NoSQL injection vulnerability was identified in the endpoint of AhnLab EPP Management. Attackers can exploit this by constructing specific MongoDB queries to extract sensitive information and Personally Identifiable Information (PII). Discovery Date: May 24, 2024 Vulnerability Type: NoSQL Injection Impact Scope Affected Versions: v1.0.14.32-6249 and earlier Fixed Versions: P14.32 > P16.25 (released in August 2024) Vendor: AhnLab Product: AhnLab EPP Management Remediation Status: Fixed. AhnLab has released patched versions (P14.32 > P16.25). Users are advised to update to the latest version as soon as possible. POC Code Sample Response Arbitrary Request Sample Sample Response ```http HTTP/1.1 200 strict-transport-security: max-age=0 x-frame-options: DENY x-content-type-options: nosniff content-type: application/json;charset=utf-8 content-length: 4516 date: Wed, 24 Apr 2024 19:52:13 GMT cache-control: no-cache,no-store,no-control connection: close {"error_code":"EPP-00000","error_msg":"success","revision":1,"response":[{"_id":{"timestamp":1713945876,"counter":150472182,"machineIdentifier":9144885,"processIdentifier":22160,"timeSecond":1713945876,"time":1713945876000,"date":1713945876000},"client_time":1713946136082,"node_id":2914,"ip":"Reacted.Reactd.Reactd","computer_name":"timwarp-k03","login_id":"Reacted","user_name":null,"mac":"40-ef-0e-c5-13-37","department":{"group":"Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","Reacted","React

Goal Reached Thanks to every supporter — we hit 100%!

AhnLab EPP Management NoSQL Injection Vulnerability (CVE-2025-60357) with POC

More from this source