Kados R10 GreenBee allows attackers to inject arbitrary SQL through the mng_profile_id parameter. By sending crafted requests that contain malicious SQL code, attackers can manipulate database queries and retrieve sensitive data stored in the system. The compromised information may include confidential business data and user credentials, resulting in a significant breach of confidentiality.

The vulnerability affects the Kados R10 GreenBee product, released by Marmotech. All installations of the R10 GreenBee edition remain at risk, as specific version ranges are not listed. Organizations using this product should consider every instance potentially vulnerable.

The vulnerability carries a high severity rating. Current exploitation probability is low, as evidenced by a very small likelihood score, and the flaw is not currently listed in the known exploited vulnerabilities catalog. Exploitation can be performed by sending HTTP requests with malicious payloads to the mng_profile_id endpoint, making the attack vector a standard web application exploitation.