CVE-2018-25395: Kados R10 GreenBee SQLi Vulnerability

CVE-2018-25395 Overview

CVE-2018-25395 is an unauthenticated SQL injection vulnerability in Kados R10 GreenBee. The flaw resides in boards_buttons/update_feature.php, where the feature_id GET parameter is concatenated directly into SQL statements without sanitization. Attackers can submit a crafted UNION-based payload to read arbitrary data from the backend database, including the current database user, database name, and DBMS version. The vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can exfiltrate database contents and enumerate the backend environment through a single crafted HTTP GET request.

Affected Products

Kados R10 GreenBee
boards_buttons/update_feature.php endpoint
Deployments tracked via the Kados SourceForge project

Discovery Timeline

2026-05-29 - CVE-2018-25395 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25395

Vulnerability Analysis

The vulnerability exists in the update_feature.php script located in the boards_buttons directory of Kados R10 GreenBee. The script accepts a feature_id parameter via HTTP GET and uses the supplied value directly inside a SQL query string. No prepared statements, parameter binding, or input validation are applied before query execution.

Because the injection point sits before any authentication enforcement, exploitation requires no credentials. Attackers can leverage UNION SELECT payloads to merge query results from arbitrary tables into the application response. Reported proof-of-concept payloads extract current_user(), database(), and version(), confirming full read access to backend metadata. Public exploit details are documented in Exploit-DB entry 45617 and the VulnCheck advisory.

Root Cause

The feature_id value is concatenated into a SQL statement as raw input. The developer did not apply type casting, escaping, or parameterized queries, so any SQL metacharacters submitted by the client become part of the executed statement.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends a single HTTP GET request to boards_buttons/update_feature.php with a UNION-based payload appended to the feature_id parameter. The backend executes the injected SQL, and the response discloses the merged data to the attacker.

No verified code example is published in this dataset. Refer to the Exploit-DB #45617 entry for the original proof-of-concept request.

Detection Methods for CVE-2018-25395

Indicators of Compromise

HTTP GET requests targeting boards_buttons/update_feature.php containing SQL keywords such as UNION, SELECT, information_schema, or -- in the feature_id parameter.
Web server access logs showing unusually long feature_id query strings or URL-encoded SQL syntax (%20UNION%20SELECT).
Database query logs containing references to current_user(), database(), or version() originating from the Kados application user.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query string parameters for SQL injection signatures on Kados endpoints.
Correlate web access logs with database audit logs to flag requests where a single HTTP transaction triggers metadata queries on information_schema.
Hunt for repeated 200-status responses to update_feature.php with varying feature_id payload lengths, which often indicates blind or UNION-based extraction.

Monitoring Recommendations

Enable verbose logging on the PHP application and the backend database to capture parameter values and executed statements.
Alert on outbound data volume anomalies from the web server hosting Kados R10 GreenBee.
Track authentication-less access to administrative or board management endpoints and review them daily.

How to Mitigate CVE-2018-25395

Immediate Actions Required

Restrict network access to the Kados R10 GreenBee web application using IP allowlists or VPN-only access until a patched build is confirmed.
Place the boards_buttons/update_feature.php endpoint behind a WAF with SQL injection rule sets enabled.
Audit the database account used by the application and revoke privileges beyond the minimum required for application function.

Patch Information

No vendor patch is referenced in the available advisory data. Administrators should monitor the Kados SourceForge project and the Kados information site for updates, and review the VulnCheck advisory for remediation guidance.

Workarounds

Replace direct string concatenation in update_feature.php with parameterized queries or prepared statements that bind feature_id as an integer.
Add server-side input validation to reject any feature_id value that is not strictly numeric before it reaches the database layer.
If the endpoint is not required, disable or remove boards_buttons/update_feature.php from the deployment to eliminate the attack surface.

bash

# Example nginx rule to block non-numeric feature_id values
location ~ /boards_buttons/update_feature\.php$ {
    if ($arg_feature_id !~ "^[0-9]+$") {
        return 403;
    }
}