CVE-2026-71231
Received Received - Intake

SQL Injection in IOTSmartHome GUI via lastLogin Cookie

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode(), which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. An unauthenticated attacker can set a lastLogin cookie containing a base64-encoded SQL injection payload (e.g. base64("' OR '1'='1")) to bypass authentication and, via UNION-based injection, extract arbitrary data including user credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-06
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71231
EUVD
EUVD-2026-53304

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thebradleysanders iotsmarthome to 2023-03-21 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in IOTSmartHome's gui/login.php. The checkCookie() function improperly handles a base64-decoded cookie value, allowing unauthenticated attackers to inject malicious SQL queries. By crafting a specially encoded cookie, attackers can bypass authentication and extract sensitive data like user credentials.

Detection Guidance

To detect this vulnerability, inspect HTTP requests for the lastLogin cookie in gui/login.php. Look for base64-encoded payloads containing SQL injection patterns like ' OR '1'='1. Use tools like curl to send test cookies with encoded SQL strings and check for authentication bypass or data leaks.

Impact Analysis

An attacker could gain full access to the system without credentials, steal user data including passwords, modify or delete database records, and potentially take control of the IOTSmartHome application. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if user credentials or health-related data are exposed. It demonstrates poor security controls, potentially leading to regulatory fines and legal consequences for failing to protect sensitive information.

Mitigation Strategies

Immediately patch the application to sanitize the lastLogin cookie before SQL query construction. Implement input validation for base64-decoded values. Temporarily disable the affected endpoint if a patch is unavailable. Monitor logs for suspicious cookie values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart