Executive brief
Kados R10 GreenBee, a web-based project management tool for Scrum and Agile teams, contains a security flaw that allows unauthorized individuals to access its internal database. By sending a specially crafted web request, an attacker can bypass security controls to view sensitive information, including database names and user credentials. This could lead to a significant data breach or unauthorized access to project management data.
Technical details
An SQL injection vulnerability exists in Kados R10 GreenBee due to improper sanitization of user-supplied input. Specifically, the 'feature_id' parameter in 'boards_buttons/update_feature.php' and the 'release_id' parameter in 'boards_buttons/update_release.php' are concatenated directly into SQL queries. An unauthenticated remote attacker can exploit this by sending crafted GET requests containing UNION-based SQL payloads. Successful exploitation allows the attacker to extract sensitive information from the database, such as the DBMS version, database name, and user information. Reports indicate over 40 files within the application may be similarly vulnerable.
Affected products
- Kados Kados R10 GreenBee R10 GreenBee and earlier
Timeline
- 2018-10-15: disclosed: Initial discovery and exploit publication by Ihsan Sencan
- 2026-05-29: advisory: CVE-2018-25395 published to NVD via VulnCheck