CVE-2018-25395
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the feature_id parameter of boards_buttons/update_feature.php. The feature_id value is concatenated directly into SQL statements without sanitization, allowing attackers to send a crafted GET request with a UNION-based payload to extract sensitive database information including the current user, database name, and DBMS version.
Risk Assessment
The risk for the organization is the potential for unauthorized access to sensitive data stored in the database, which could lead to information leakage, data integrity compromise, and further attacks on the system.
Recommendation
It is recommended to immediately update the Kados R10 GreenBee software to the latest version that fixes this vulnerability, and to implement input validation and parameterized SQL queries for all input parameters.
Other vulnerabilities in Kados R10 GreenBee
See all- CVE-2018-25394High
Kados R10 GreenBee contains an SQL injection vulnerability in boards_buttons/update_release.php. Unauthenticated attackers can inject arbitrary SQL queries via the release_id parameter, which is directly concatenated into SQL statements without sanitization. Attackers can send a crafted GET request with a UNION-based payload to extract sensitive database information such as the current user, database name, and DBMS version.
- CVE-2019-25704High
SQL injection vulnerability in Kados R10 GreenBee via the filter_user_mail parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25702High
SQL injection vulnerability in Kados R10 GreenBee via the id_project parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25700High
SQL injection vulnerability in Kados R10 GreenBee via the sort_direction parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25698High
SQL injection vulnerability in Kados R10 GreenBee via the id_to_delete parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25696High
SQL injection vulnerability in Kados R10 GreenBee via the language_tag parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25694High
Kados R10 GreenBee has an SQL injection vulnerability in the user2reset parameter, allowing unauthenticated attackers to manipulate database queries. Attackers can send crafted requests with malicious SQL to extract or modify sensitive data.
- CVE-2019-25692High
SQL injection vulnerability in Kados R10 GreenBee via the id_to_modify parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25690High
SQL injection vulnerability in Kados R10 GreenBee via the mng_profile_id parameter. Attackers can inject malicious SQL to extract sensitive database information.
- CVE-2019-25688High
Kados R10 GreenBee has an SQL injection vulnerability via the menu_lev1 parameter, allowing unauthenticated attackers to manipulate database queries.
Original NVD description (English source)
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the feature_id parameter of boards_buttons/update_feature.php. The feature_id value is concatenated directly into SQL statements without sanitization, allowing attackers to send a crafted GET request with a UNION-based payload to extract sensitive database information including the current user, database name, and DBMS version.