PatchSiren cyber security CVE debrief
CVE-2018-25395 Kados CVE debrief
CVE-2018-25395 documents an unauthenticated SQL injection vulnerability in Kados R10 GreenBee, a project management application. The flaw exists in the `feature_id` parameter of `boards_buttons/update_feature.php`, where user-supplied input is concatenated directly into SQL statements without sanitization. Attackers can exploit this via crafted GET requests using UNION-based payloads to extract sensitive database information including current user, database name, and DBMS version. The vulnerability carries a CVSS 4.0 score of 8.8 (HIGH severity) with network attack vector, low attack complexity, no privileges required, and high confidentiality impact. The CVE was published to NVD on 2026-05-29 with a status of 'Deferred'. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV.
- Vendor
- Kados
- Product
- Kados R10 GreenBee
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations running Kados R10 GreenBee for project management; security teams responsible for legacy PHP application security; developers maintaining forked versions of Kados; incident response teams monitoring for SQL injection indicators of compromise
Technical summary
The vulnerability resides in boards_buttons/update_feature.php where the feature_id parameter is directly concatenated into SQL queries without sanitization. An unauthenticated attacker can send a crafted GET request with a UNION-based SQL payload to execute arbitrary queries. Successful exploitation enables extraction of database metadata including current database user, database name, and DBMS version. The attack requires no authentication and can be performed remotely with low complexity.
Defensive priority
HIGH
Recommended defensive actions
- Apply input validation and parameterized queries to the feature_id parameter in boards_buttons/update_feature.php
- Implement prepared statements or stored procedures to prevent SQL injection
- Conduct code review of all database interaction points in the Kados R10 GreenBee codebase
- Deploy Web Application Firewall (WAF) rules to detect and block SQL injection attempts against the identified endpoint
- Monitor access logs for suspicious GET requests to boards_buttons/update_feature.php containing SQL keywords or UNION statements
- Consider migrating to actively maintained project management software if vendor support is unavailable
Evidence notes
SQL injection confirmed via direct source code analysis showing unsanitized parameter concatenation. CWE-89 (Improper Neutralization of Special Elements in SQL Command) is the primary weakness classification. The CVSS 4.0 vector indicates high confidentiality impact with no integrity or availability impact under the base metrics.
Official resources
The vulnerability was disclosed via VulnCheck advisory and published to Exploit-DB. The affected product is Kados R10 GreenBee, an open-source project management tool historically hosted on SourceForge.