CVE-2019-25688
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Kados R10 GreenBee has an SQL injection vulnerability via the menu_lev1 parameter, allowing unauthenticated attackers to manipulate database queries.
Risk Assessment
An unauthenticated attacker can extract or modify sensitive data in the database.
Recommendation
Update the software or apply input filtering for the menu_lev1 parameter.
Other vulnerabilities in Kados R10 GreenBee
See all- CVE-2018-25395High
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the feature_id parameter of boards_buttons/update_feature.php. The feature_id value is concatenated directly into SQL statements without sanitization, allowing attackers to send a crafted GET request with a UNION-based payload to extract sensitive database information including the current user, database name, and DBMS version.
- CVE-2018-25394High
Kados R10 GreenBee contains an SQL injection vulnerability in boards_buttons/update_release.php. Unauthenticated attackers can inject arbitrary SQL queries via the release_id parameter, which is directly concatenated into SQL statements without sanitization. Attackers can send a crafted GET request with a UNION-based payload to extract sensitive database information such as the current user, database name, and DBMS version.
- CVE-2019-25704High
SQL injection vulnerability in Kados R10 GreenBee via the filter_user_mail parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25702High
SQL injection vulnerability in Kados R10 GreenBee via the id_project parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25700High
SQL injection vulnerability in Kados R10 GreenBee via the sort_direction parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25698High
SQL injection vulnerability in Kados R10 GreenBee via the id_to_delete parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25696High
SQL injection vulnerability in Kados R10 GreenBee via the language_tag parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25694High
Kados R10 GreenBee has an SQL injection vulnerability in the user2reset parameter, allowing unauthenticated attackers to manipulate database queries. Attackers can send crafted requests with malicious SQL to extract or modify sensitive data.
- CVE-2019-25692High
SQL injection vulnerability in Kados R10 GreenBee via the id_to_modify parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25690High
SQL injection vulnerability in Kados R10 GreenBee via the mng_profile_id parameter. Attackers can inject malicious SQL to extract sensitive database information.
Original NVD description (English source)
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the menu_lev1 parameter. Attackers can send crafted requests with malicious SQL payloads in the menu_lev1 parameter to extract sensitive database information or modify database contents.