Kados R10 GreenBee vulnerabilities

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the feature_id parameter of boards_buttons/update_feature.php. The feature_id value is concatenated directly into SQL statements without sanitization, allowing attackers to send a crafted GET request with a UNION-based payload to extract sensitive database information including the current user, database name, and DBMS version.

Kados R10 GreenBee contains an SQL injection vulnerability in boards_buttons/update_release.php. Unauthenticated attackers can inject arbitrary SQL queries via the release_id parameter, which is directly concatenated into SQL statements without sanitization. Attackers can send a crafted GET request with a UNION-based payload to extract sensitive database information such as the current user, database name, and DBMS version.

SQL injection vulnerability in Kados R10 GreenBee via the filter_user_mail parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the id_project parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the sort_direction parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the id_to_delete parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the language_tag parameter. Attackers can inject malicious SQL to extract or modify database data.

Kados R10 GreenBee has an SQL injection vulnerability in the user2reset parameter, allowing unauthenticated attackers to manipulate database queries. Attackers can send crafted requests with malicious SQL to extract or modify sensitive data.

SQL injection vulnerability in Kados R10 GreenBee via the id_to_modify parameter. Attackers can inject malicious SQL to extract or modify database data.

SQL injection vulnerability in Kados R10 GreenBee via the mng_profile_id parameter. Attackers can inject malicious SQL to extract sensitive database information.

Kados R10 GreenBee has an SQL injection vulnerability via the menu_lev1 parameter, allowing unauthenticated attackers to manipulate database queries.