Kados R10 GreenBee contains a flaw in boards_buttons/update_release.php where the release_id parameter is concatenated directly into SQL statements without sanitization, enabling attackers to inject arbitrary SQL queries. The vulnerability allows unauthenticated attackers to extract sensitive database information such as the current user, database name, and DBMS version, potentially exposing confidential data and facilitating further attacks depending on database privileges. This is a classic SQL injection identified as CWE-89.

The vulnerability affects the Kados R10 GreenBee product. No specific version information is provided in the CVE data, so all installations of Kados R10 GreenBee should be considered potentially impacted until a patch is applied.

The CVSS score of 8.8 indicates a high severity, and the exploit is believed to be possible via unauthenticated web requests without any special privileges. The EPSS score is not available, and the issue is not listed in CISA KEV, but the high CVSS suggests the exploit could be attempted by threat actors. The likely attack vector is a crafted GET request to update_release.php with a UNION-based payload, as indicated by the description. Because no additional mitigation steps are noted from the CNA, the vulnerability remains a significant risk until remedied.