vendor:
Kados R10 GreenBee
by:
Ihsan Sencan
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Kados R10 GreenBee
Affected Version From: R10 GreenBee
Affected Version To: R10 GreenBee
Patch Exists: NO
Related CWE: N/A
CPE: a:kados:kados_r10_greenbee
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: WiN7_x64/KaLiLinuX_x64
2018
Kados R10 GreenBee – ‘release_id’ SQL Injection
All users can run sql injection codes. The POC involves sending a malicious GET request to the update_release.php page with a malicious 'release_id' parameter. This parameter is not properly sanitized and can be used to inject malicious SQL code.
Mitigation:
Input validation and sanitization should be used to prevent SQL injection attacks.