Kados R10 GreenBee is vulnerable to a classic SQL injection that can be triggered by sending crafted input in the sort_direction parameter of the web interface. An attacker who successfully injects malicious SQL can retrieve sensitive database contents or alter data, potentially compromising confidentiality, integrity, and the reliability of the application.

The vulnerability affects the Kados R10 GreenBee product from the Kados vendor. No specific version information is provided in the CVE data; any installation of the product is presumed to be affected until a patch is applied.

The CVSS score of 8.8 highlights a high severity level, while the EPSS score of less than 1% indicates a low likelihood that this vulnerability is actively exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves accessing the web application and sending an HTTP request that includes a malicious payload in the sort_direction parameter. It is inferred that the exploit could be performed without special privileges, making it potentially reachable to unauthenticated users who can reach the affected endpoint.