Executive brief
Kados R10 GreenBee, a web-based project management tool for Scrum and Agile teams, is vulnerable to SQL injection. This flaw allows an attacker to manipulate database queries, potentially leading to the unauthorized viewing or modification of sensitive project data, user information, and system configurations. Organizations using this tool for project tracking may face risks to data integrity and confidentiality.
Technical details
Kados R10 GreenBee is vulnerable to multiple SQL injection flaws due to improper neutralization of special elements in SQL commands (CWE-89). The vulnerability exists in several parameters, most notably 'id_to_delete', 'menu_lev1', 'mng_profile_id', 'id_to_modify', and 'user2reset'. An unauthenticated remote attacker can send specially crafted GET requests containing malicious SQL statements to these parameters. Successful exploitation allows the attacker to extract sensitive data from the MySQL database, modify records, or perform blind SQL injection (e.g., using SLEEP commands). While a newer version (R11-YellowCat) was released in late 2019, users should verify if these specific vulnerabilities are addressed or migrate to the latest supported version.
Affected products
- Kados Kados R10 GreenBee R10 GreenBee
Timeline
- 2019-03-07: disclosed: Exploit code published on Exploit-DB
- 2019-12-22: other: Newer version R11-YellowCat released
- 2026-04-05: advisory: CVE-2019-25698 published