← CVE Intelligence

CVE-2026-71231

IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie PUBLISHED

Description (CNA)

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.

Affected (CNA)

Vendor / productVersions
thebradleysanders / IOTSmartHomeaffected 0

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.