Executive brief
Kados R10 GreenBee, a web-based tool for managing Scrum and Agile projects, is vulnerable to SQL injection. This flaw allows an attacker to manipulate database queries to view sensitive information or modify data within the project management system. Such an exploit could lead to the unauthorized disclosure of project roadmaps, user credentials, or the alteration of critical project tasks and records.
Technical details
Kados R10 GreenBee is vulnerable to multiple SQL injection entry points due to improper neutralization of special elements in SQL commands (CWE-89). Attackers can inject malicious SQL code via several GET parameters, including 'sort_direction', 'menu_lev1', 'mng_profile_id', 'id_to_modify', and 'user2reset'. The vulnerability is reachable over the network without authentication in some instances, or with standard user privileges in others. Successful exploitation allows for data exfiltration from the MySQL database, data modification, or time-based blind SQL injection attacks. While a newer version (R11-YellowCat) was released in late 2019, users should verify if these specific vulnerabilities were addressed or migrate to the latest supported version.
Affected products
- Kados Kados R10 GreenBee R10 GreenBee
Timeline
- 2019-03-07: disclosed: Exploit code published on Exploit-DB
- 2019-12-22: other: Release of version R11-YellowCat
- 2026-04-05: advisory: CVE-2019-25700 published by NVD