Executive brief
Kados R10 GreenBee, a web-based project management tool for Scrum and Agile teams, is vulnerable to SQL injection. This flaw allows an attacker to manipulate database queries by sending specially crafted web requests. Successful exploitation could lead to the unauthorized extraction of sensitive business data, including project details and user information, potentially compromising the confidentiality of corporate operations.
Technical details
Kados R10 GreenBee is vulnerable to multiple SQL injection flaws, most notably in the 'mng_profile_id' parameter within the administration/profiles.php component. The vulnerability is caused by improper neutralization of special elements used in SQL commands (CWE-89). An unauthenticated remote attacker can exploit this by sending crafted GET requests containing malicious SQL payloads. Beyond 'mng_profile_id', other parameters such as 'menu_lev1', 'id_to_modify', and 'user2reset' are also reported as vulnerable, enabling both error-based and blind SQL injection. This allows for the extraction of sensitive data from the underlying MySQL database. While a newer version (R11-YellowCat) was released in late 2019, users should verify if these specific flaws are addressed or migrate to the latest version.
Affected products
- Kados Kados R10 GreenBee R10 GreenBee
Timeline
- 2019-03-07: disclosed: Exploit code published on Exploit-DB
- 2019-12-22: other: Release of R11-YellowCat version
- 2026-04-05: advisory: CVE-2019-25690 published to NVD