Kados R10 GreenBee permits arbitrary SQL injection through the "id_to_delete" parameter. An attacker who can reach this endpoint may supply malicious SQL fragments that are concatenated into backend queries, enabling the extraction or modification of sensitive database information. This vulnerability is a classic SQL injection flaw, which jeopardizes confidentiality, integrity, and potentially availability of the affected system.

The flaw affects all deployments of Kados R10 GreenBee that include the id_to_delete handling code. No specific version range is listed, so any instance using this functionality is at risk.

The CVSS score of 8.8 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests current exploit prevalence is low. The vulnerability is not cataloged in the CISA KEV list. The likely attack vector is through a web request to the vulnerable endpoint, where an attacker supplies crafted SQL code in the id_to_delete parameter. Exploitation requires network access to the application or a user to trigger the injection, and no privileged access is needed beyond normal usage of that function.