Kados R10 GreenBee contains a critical SQL injection vulnerability in the feature_id parameter of boards_buttons/update_feature.php. Unauthenticated attackers can exploit this vulnerability to execute arbitrary SQL queries through crafted GET requests with UNION-based payloads. The vulnerability exists because user input is concatenated directly into SQL statements without proper sanitization. Attackers can extract sensitive database information including current user credentials, database names, and DBMS version information. This represents a significant security risk for systems running the affected Kados R10 GreenBee software.