CVE-2019-25694
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Kados R10 GreenBee has an SQL injection vulnerability in the user2reset parameter, allowing unauthenticated attackers to manipulate database queries. Attackers can send crafted requests with malicious SQL to extract or modify sensitive data.
Risk Assessment
An unauthenticated attacker can access or modify sensitive database information (e.g., user data, passwords), compromising system confidentiality and integrity.
Recommendation
Apply the vendor's patch immediately, or if unavailable, disable access to the user2reset parameter and implement server-side input validation.
Other vulnerabilities in Kados R10 GreenBee
See all- CVE-2018-25395High
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the feature_id parameter of boards_buttons/update_feature.php. The feature_id value is concatenated directly into SQL statements without sanitization, allowing attackers to send a crafted GET request with a UNION-based payload to extract sensitive database information including the current user, database name, and DBMS version.
- CVE-2018-25394High
Kados R10 GreenBee contains an SQL injection vulnerability in boards_buttons/update_release.php. Unauthenticated attackers can inject arbitrary SQL queries via the release_id parameter, which is directly concatenated into SQL statements without sanitization. Attackers can send a crafted GET request with a UNION-based payload to extract sensitive database information such as the current user, database name, and DBMS version.
- CVE-2019-25704High
SQL injection vulnerability in Kados R10 GreenBee via the filter_user_mail parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25702High
SQL injection vulnerability in Kados R10 GreenBee via the id_project parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25700High
SQL injection vulnerability in Kados R10 GreenBee via the sort_direction parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25698High
SQL injection vulnerability in Kados R10 GreenBee via the id_to_delete parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25696High
SQL injection vulnerability in Kados R10 GreenBee via the language_tag parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25692High
SQL injection vulnerability in Kados R10 GreenBee via the id_to_modify parameter. Attackers can inject malicious SQL to extract or modify database data.
- CVE-2019-25690High
SQL injection vulnerability in Kados R10 GreenBee via the mng_profile_id parameter. Attackers can inject malicious SQL to extract sensitive database information.
- CVE-2019-25688High
Kados R10 GreenBee has an SQL injection vulnerability via the menu_lev1 parameter, allowing unauthenticated attackers to manipulate database queries.
Original NVD description (English source)
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user2reset parameter. Attackers can send crafted requests with malicious SQL payloads to extract sensitive database information or modify data.