CVE-2019-25690
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
SQL injection vulnerability in Kados R10 GreenBee via the mng_profile_id parameter. Attackers can inject malicious SQL to extract sensitive database information.
Risk Assessment
An attacker could gain unauthorized access to sensitive data, leading to confidentiality breaches.
Recommendation
Apply input filtering and parameterized queries for the mng_profile_id parameter. Update the software to a patched version.
Other vulnerabilities in Kados R10 GreenBee
See all- CVE-2018-25395High
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the feature_id parameter of boards_buttons/update_feature.php. The feature_id value is concatenated directly into SQL statements without sanitization, allowing attackers to send a crafted GET request with a UNION-based payload to extract sensitive database information including the current user, database name, and DBMS version.
- CVE-2018-25394High
Kados R10 GreenBee contains an SQL injection vulnerability in boards_buttons/update_release.php. Unauthenticated attackers can inject arbitrary SQL queries via the release_id parameter, which is directly concatenated into SQL statements without sanitization. Attackers can send a crafted GET request with a UNION-based payload to extract sensitive database information such as the current user, database name, and DBMS version.
- CVE-2019-25704High
SQL injection vulnerability in Kados R10 GreenBee via the filter_user_mail parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25702High
SQL injection vulnerability in Kados R10 GreenBee via the id_project parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25700High
SQL injection vulnerability in Kados R10 GreenBee via the sort_direction parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25698High
SQL injection vulnerability in Kados R10 GreenBee via the id_to_delete parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25696High
SQL injection vulnerability in Kados R10 GreenBee via the language_tag parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25694High
Kados R10 GreenBee has an SQL injection vulnerability in the user2reset parameter, allowing unauthenticated attackers to manipulate database queries. Attackers can send crafted requests with malicious SQL to extract or modify sensitive data.
- CVE-2019-25692High
SQL injection vulnerability in Kados R10 GreenBee via the id_to_modify parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25688High
Kados R10 GreenBee has an SQL injection vulnerability via the menu_lev1 parameter, allowing unauthenticated attackers to manipulate database queries.
Original NVD description (English source)
Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the mng_profile_id parameter. Attackers can send crafted requests with malicious SQL payloads in the mng_profile_id parameter to extract sensitive database information.