CVE-2018-25395: Kados R10 GreenBee SQL Injection Vulnerability – Unauthenticated Database Access

Technical summary

The vulnerability exists in boards_buttons/update_feature.php where the feature_id parameter is concatenated directly into SQL query strings without input validation or prepared statement use. An attacker can submit a GET request with a UNION-based SQL injection payload to the unprotected endpoint, bypassing the need for authentication. The injected SQL executes in the context of the database user, allowing enumeration of database metadata (current user, database name, DBMS version) and extraction of arbitrary table data. The vulnerability is classified as CWE-89 (SQL Injection).

Business impact

An attacker exploiting this vulnerability gains unauthorized read access to the entire application database without credentials. Depending on data stored in Kados R10 GreenBee, this could expose customer records, authentication tokens, configuration secrets, or other sensitive operational data. The combination of no authentication requirement and high information disclosure capability creates significant risk for data breaches and potential regulatory compliance violations (GDPR, HIPAA, etc. depending on data classification).

Affected systems

Kados R10 GreenBee is affected. No specific version ranges or patch versions have been disclosed in available sources; organizations using this product should consult the vendor advisory for definitive affected version information and remediation guidance.

Exploitability

This vulnerability is readily exploitable. It requires only network access to the affected endpoint, no authentication, and no user interaction. SQL injection payloads are well-understood attack techniques with publicly available tools and examples. The network-accessible nature (AV:N), low attack complexity (AC:L), and lack of required privileges (PR:N) make this a practical target for both opportunistic and targeted attackers.

Remediation

Immediate patching from Kados is the primary remediation. Until a patch is available, implement network-level access controls to restrict access to the boards_buttons directory to trusted networks only. Input validation and parameterized queries should be implemented by the vendor in a patch release. Organizations should verify against the vendor's official advisory for exact patch availability and version numbers.

Patch guidance

Contact Kados for patch availability and version information, or check the vendor's security advisories directly. Apply patches immediately upon release given the unauthenticated nature of the exploit. Test patches in a non-production environment before deployment. Verify patch effectiveness by confirming that direct SQL injection payloads to the feature_id parameter are no longer executed.

Detection guidance

Monitor web server logs and WAF logs for suspicious GET requests to boards_buttons/update_feature.php containing SQL keywords (UNION, SELECT, WHERE) or special characters (quotes, semicolons, dashes) in the feature_id parameter. Search for patterns like '%20UNION%20', '%27OR%271%27', or encoded variants. Implement database query logging to detect unusual SELECT statements querying system tables like information_schema. Network-based IDS/IPS signatures targeting SQL injection in HTTP parameters should be enabled.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of high confidentiality impact (C:H), unauthenticated attack surface (PR:N, UI:N), and network accessibility (AV:N). The ability to extract sensitive database contents without any credentials or user interaction creates material risk. Organizations should treat this as critical and patch or mitigate within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects high confidentiality impact from database information disclosure, combined with low attack complexity and complete lack of access barriers. The integrity impact is rated as low because the vulnerability is read-focused (data extraction via UNION queries), not write-focused, though database enumeration could facilitate subsequent modifications. Availability is unaffected.

Frequently asked questions