CVE-2019-25700 is a SQL injection flaw in Kados R10 GreenBee, scored 8.2 (high) by CVSS 3.1. The sort_direction parameter reaches a database query without safe handling. The record names no fixed version, so treat the application as unpatched, restrict who can reach it, and plan to replace or fix it.
What's affected
The record lists Kados R10 GreenBee from marmotech. Kados is an open source school and project management application distributed through SourceForge. The record does not give a version range beyond "R10 GreenBee" and does not name a fixed release.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, which means it is reachable over the network, needs no special conditions and needs no login. Confidentiality impact is rated high and integrity impact low, with no availability impact.
How to check if you're exposed
There is no package manager command for this one, because Kados is installed as a standalone web application. Work through these checks instead.
- Find out whether anyone in your organization runs Kados. Look at web server virtual hosts, old school or project portals, and shared hosting accounts.
- Check the installed release in the application files or the admin pages. If it says R10 GreenBee, it is in scope.
- Search web server access logs for unusual values in the sort_direction parameter, such as very long strings, quote characters or SQL keywords.
- Check whether the application is reachable from the internet or only from an internal network.
What to do now
- Inventory every Kados installation, including forgotten test and archive copies.
- Check the project pages listed in the Sources section for a newer release or a patch. The record does not name one, so confirm on the project site.
- If you cannot confirm a fix, take internet facing installations offline or put them behind a VPN or an IP allowlist.
- Place a web application firewall rule or reverse proxy filter in front of the application as a stopgap, and understand that this reduces risk but does not fix the code.
- Rotate any credentials stored in the Kados database if you suspect the sort_direction parameter was probed.
- Plan a replacement if the project is no longer maintained.
Why it matters
The weakness is CWE-89, SQL injection. The application builds a database query by putting request data straight into the query text. The database cannot tell which part is the developer's instruction and which part came from the visitor, so crafted input can change what the query does.
Sort parameters are a classic weak spot. Prepared statements cannot bind a column name or a sort direction, so developers often paste the value into the query. The safe pattern is to map the input to a fixed list of allowed values such as ascending and descending.
The fix for this class is well understood. Use parameterized queries or prepared statements so that input is always treated as data, validate values against an allowlist where only a few are valid, and give the application database account only the rights it needs. None of this is complicated, but it has to be applied to every query in the code base, which is why one reported parameter is often a sign of others.
Quick check
Why are sort parameters often vulnerable?
Query parameter binding covers values, not keywords or column names, so developers concatenate sort fields into the query text. Use an allowlist instead.
Sources
- Kados project on SourceForge
- Kados project site
- VulnCheck advisory
- Exploit-DB entry referenced by the record
Last reviewed: 19 October 2026.
