# CVE-2019-25692: Kados R10 GreenBee SQL injection in id_to_modify parameter

Source: https://junglewise.ai/threats/cve-2019-25692-kados-r10-greenbee-sql-injection-in-id-to-modify-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2019-25692 · Severity: high · CVSS 8.2 · Published 2026-04-05

Kados R10 GreenBee, a web-based project management tool for Scrum and Agile teams, contains a security vulnerability that allows unauthorized access to its database. By sending specially crafted web requests, an attacker can bypass security controls to view sensitive information or modify data within the system. This could lead to the exposure of confidential project details, user credentials, or the unauthorized alteration of project management records.

Technologies: [Kados R10 GreenBee](https://junglewise.ai/threats/technologies/kados-r10-greenbee). Vendors: [Kados](https://junglewise.ai/threats/vendors/kados).

## Quick answers

**Is CVE-2019-25692 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25692 being exploited in the wild.

**How severe is CVE-2019-25692?** High severity, with a CVSS score of 8.2, published 5 April 2026.

**Which products and versions are affected?** Kados R10 GreenBee R10 GreenBee.

**Is there a fix for CVE-2019-25692?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25692 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2019-25692?** Check whether you run Kados R10 GreenBee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists in Kados R10 GreenBee due to improper neutralization of special elements in the 'id_to_modify' parameter used in database queries. The flaw is reachable via the 'administration/parameters.php' and 'administration/news.php' endpoints. A remote, unauthenticated attacker can exploit this by sending crafted GET requests containing malicious SQL statements. Successful exploitation allows the attacker to extract sensitive information from the database or modify existing records. Public exploit code (PoC) is available, demonstrating both error-based and blind SQL injection techniques across multiple parameters including 'menu_lev1', 'mng_profile_id', and 'user2reset'.

## Affected products

- Kados Kados R10 GreenBee R10 GreenBee

## Timeline

- 2019-03-07: disclosed: Exploit code published on Exploit-DB
- 2026-04-05: advisory: NVD publication date

## References

- [https://sourceforge.net/projects/kados/](https://sourceforge.net/projects/kados/)
- [https://www.exploit-db.com/exploits/46505](https://www.exploit-db.com/exploits/46505)
- [https://www.kados.info/](https://www.kados.info/)
- [https://www.vulncheck.com/advisories/kados-r10-greenbee-sql-injection-via-id-to-modify-parameter](https://www.vulncheck.com/advisories/kados-r10-greenbee-sql-injection-via-id-to-modify-parameter)

## Related threats

- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25704-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25702-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25700-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25698-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in language_tag parameter](https://junglewise.ai/threats/cve-2019-25696-kados-r10-greenbee-sql-injection-in-language-tag-parameter)