Quick answers
- Is CVE-2019-25704 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-25704 being exploited in the wild.
- How severe is CVE-2019-25704?
- High severity, with a CVSS score of 8.2, published 5 April 2026.
- Which products and versions are affected?
- Kados R10 GreenBee R10 GreenBee.
- Is there a fix for CVE-2019-25704?
- A patch was published on 2019-12-22: New version R11-YellowCat released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-25704 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2019-25704?
- Check whether you run Kados R10 GreenBee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An SQL injection vulnerability exists in Kados R10 GreenBee due to improper neutralization of special elements in several parameters, most notably 'filter_user_mail', 'menu_lev1', 'mng_profile_id', and 'id_to_modify'. The flaw is reachable via unauthenticated or low-privileged GET requests to various PHP endpoints including projects.php and users.php. An attacker can exploit this to perform out-of-band data extraction, error-based SQL injection, or time-based blind SQL injection. This allows for the unauthorized retrieval of sensitive database contents or the modification of existing records. While the vulnerability was identified in 2019, it was formally assigned a CVE in 2026; users should upgrade to a supported version such as R11-YellowCat or later.
Affected products
- Kados Kados R10 GreenBee R10 GreenBee
Timeline
- 2019-03-07: disclosed: Exploit code published on Exploit-DB
- 2019-12-22: patched: New version R11-YellowCat released
- 2026-04-05: advisory: CVE-2019-25704 published