CVE-2019-25694
Published: 05 April 2026
Summary
CVE-2019-25694 is a high-severity SQL Injection (CWE-89) vulnerability in Marmotech Kados. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-25694 is an SQL injection vulnerability (CWE-89) in Kados R10 GreenBee, where the user2reset parameter fails to properly sanitize input. This allows attackers to inject malicious SQL code directly into database queries. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability disruption.
Unauthenticated remote attackers can exploit this vulnerability by sending crafted HTTP requests containing SQL payloads via the user2reset parameter. Successful exploitation enables manipulation of database queries, allowing extraction of sensitive information from the database or limited modification of data.
Advisories provide further details, including a dedicated entry from VulnCheck at https://www.vulncheck.com/advisories/kados-r10-greenbee-sql-injection-via-user2reset and a public proof-of-concept exploit at https://www.exploit-db.com/exploits/46505. Additional resources include the Kados project pages at https://sourceforge.net/projects/kados/ and https://www.kados.info/. No specific patch or mitigation steps are detailed in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20115
Vulnerability details
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user2reset parameter. Attackers can send crafted requests with malicious SQL payloads to extract sensitive database information or modify…
more
data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated SQL injection in a public-facing web application enables remote exploitation for data access/modification via crafted HTTP requests.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires information input validation at entry points, directly preventing SQL injection via unsanitized parameters like user2reset in Kados R10 GreenBee.
SI-2 mandates identification, reporting, prioritization, and remediation of flaws, including patching the SQL injection vulnerability in CVE-2019-25694.
RA-5 requires vulnerability scanning to detect SQL injection flaws like CVE-2019-25694 in applications such as Kados R10 GreenBee.