CVE-2018-25394

Vulnerability

Kados R10 GreenBee (version R10 GreenBee) contains an SQL injection vulnerability in the boards_buttons/update_release.php script. The release_id parameter is directly concatenated into SQL queries without sanitization, as shown in the source code: $request=new sqlRequest("SELECT * FROM kados_releases WHERE release_id=".$_REQUEST['release_id'],$cnx->num); [2]. This allows unauthenticated attackers to inject arbitrary SQL via a crafted GET request. The vulnerability affects all installations of Kados R10 GreenBee [1][2][3][4].

Exploitation

An attacker can exploit this vulnerability by sending a GET request to /boards_buttons/update_release.php with a malicious release_id parameter. No authentication is required. The exploit demonstrated in [2] uses a UNION-based payload to extract information. For example, the URL-encoded payload %2d%31%20%20%55%4e%49%4f%4e... (decoded: -1 UNION SELECT 1,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),3,4,5,6,7,8,9-- -) retrieves the current database user, database name, and DBMS version [2]. The attacker only needs network access to the target web application.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL queries, leading to disclosure of sensitive database information such as user credentials, database contents, and server version. The attacker can potentially extract all data from the database, including user tables, project data, and configuration details [2][4]. The impact is limited to information disclosure; however, depending on database permissions, further escalation may be possible.

Mitigation

As of the available references, no official patch has been released for Kados R10 GreenBee. The vendor's website (kados.info) and SourceForge page do not mention a fix [1][3]. Users are advised to upgrade to a newer version if available, or implement input validation and parameterized queries for the release_id parameter. If no update is provided, consider disabling or restricting access to the vulnerable script. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.