CVE-2019-25690
Published: 05 April 2026
Summary
CVE-2019-25690 is a high-severity SQL Injection (CWE-89) vulnerability in Marmotech Kados. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25690 is an SQL injection vulnerability (CWE-89) in Kados R10 GreenBee, where the mng_profile_id parameter fails to properly sanitize user input. This allows attackers to inject and execute arbitrary SQL code, manipulating database queries. The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with network accessibility and no prerequisites for privileges or user interaction.
Unauthenticated remote attackers can exploit this vulnerability by sending crafted HTTP requests containing malicious SQL payloads in the mng_profile_id parameter. Successful exploitation enables extraction of sensitive database information, such as user credentials or other confidential data stored in the backend database.
Advisories and references, including a Vulncheck advisory on the Kados R10 GreenBee SQL injection and an Exploit-DB entry (46505) with a proof-of-concept exploit, document the issue. Project resources are available at SourceForge and kados.info, though no specific patch or mitigation details are provided in the CVE description.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20111
Vulnerability details
Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the mng_profile_id parameter. Attackers can send crafted requests with malicious SQL payloads in the mng_profile_id parameter to extract sensitive database…
more
information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a public-facing web application directly enables remote unauthenticated exploitation for initial access and database data retrieval.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly and comprehensively prevents SQL injection in CVE-2019-25690 by requiring validation and sanitization of user inputs like the mng_profile_id parameter.
SI-2 mandates timely identification, reporting, and remediation of software flaws such as the SQL injection vulnerability in CVE-2019-25690.
RA-5 requires vulnerability scanning that detects SQL injection vulnerabilities like CVE-2019-25690 in web applications such as Kados R10 GreenBee.