Executive brief
Kados, a web-based project management tool for Scrum and Agile teams, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted web requests, an attacker can bypass security controls to view sensitive information, including database structures and user details. This could lead to the exposure of confidential project data or provide a foothold for further attacks on the organization's infrastructure.
Technical details
An SQL injection vulnerability exists in Kados R10 GreenBee due to improper sanitization of user-supplied input in the 'release_id' and 'feature_id' parameters. Specifically, in boards_buttons/update_release.php and boards_buttons/update_feature.php, input is concatenated directly into SQL statements. A remote, unauthenticated attacker can exploit this by sending crafted GET requests containing UNION-based payloads. Successful exploitation allows the attacker to execute arbitrary SQL commands, potentially leading to the extraction of sensitive data such as database names, user credentials, and DBMS version information. Reports indicate over 40 files within the application may be similarly affected.
Affected products
- Marmotte Technologies Kados R10 GreenBee and earlier
Timeline
- 2018-10-15: disclosed: Initial discovery and exploit publication by Ihsan Sencan
- 2019-12-22: patched: Version R11-YellowCat released which may address technical debt, though advisory specifically targets R10
- 2026-05-29: advisory: CVE-2018-25394 assigned and published via VulnCheck/NVD