Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code th…

Kados R10 GreenBee contains an SQL injection vulnerability in the release_id parameter of boards_buttons/update_release.php. The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries through direct concatenation without sanitization. Attackers can exploit this using crafted GET requests with UNION-based payloads. The vulnerability enables extraction of sensitive database information including current user, database name, and DBMS version. This represents a critical security flaw affecting the Kados R10 GreenBee application.