CVE-2019-25688

Name of the Vulnerable Software and Affected Versions Kados R10 GreenBee (affected versions not specified)

Description An SQL injection flaw allows unauthenticated attackers to manipulate database queries. By sending crafted requests containing malicious SQL payloads via the menu lev1 parameter, an attacker can extract sensitive information from the database or modify its contents. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the menu lev1 parameter until the issue is resolved.