Kados R10 GreenBee SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Kados R10 GreenBee, a web-based tool for managing Scrum projects. This vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'user2reset' parameter. Exploitation of this vulnerability could lead to the extraction or modification of sensitive database information.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries, potentially leading to unauthorized data access or modification.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the 'administration/users.php' endpoint, including a malicious payload in the 'user2reset' parameter. This can be done using a SQL injection technique that, for example, extracts data from the database or modifies existing data.