Executive brief
Kados R10 GreenBee, a web-based project management tool for Scrum and Agile teams, contains a security vulnerability that allows unauthorized individuals to interfere with its database. By sending specially crafted web requests, an attacker can bypass security controls to view sensitive project information or modify data. This could lead to the exposure of confidential business plans, user credentials, or the corruption of project management records.
Technical details
A SQL injection vulnerability exists in Kados R10 GreenBee due to improper neutralization of special elements in several HTTP GET parameters, most notably 'id_project', 'menu_lev1', 'mng_profile_id', and 'id_to_modify'. A remote, unauthenticated attacker can exploit this by sending crafted requests containing malicious SQL statements. Successful exploitation allows for the extraction of sensitive data from the MySQL database (including via error-based and blind SQLi techniques) or unauthorized modification of records. The vulnerability affects the PHP-based web application and was publicly disclosed with proof-of-concept exploits. Users should upgrade to a patched version or the newer R11-YellowCat release if available.
Affected products
- Kados Kados R10 GreenBee R10 GreenBee
Timeline
- 2019-03-07: disclosed: Exploit code published on Exploit-DB
- 2026-04-05: advisory: CVE-2019-25702 published by NVD/VulnCheck