{"id":"CVE-2026-71231","aliases":["EUVD-2026-53304","GHSA-hchq-288f-9hjc"],"status":"published","title":"IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie","description":"IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='\u003cdecoded lastLogin cookie\u003e' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00665,"percentile":0.52276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-08-05T10:56:07Z","modified":"2026-11-04T02:30:30Z","products":[{"vendor":"thebradleysanders","product":"iotsmarthome"}],"references":[{"url":"https://github.com/thebradleysanders/IOTSmartHome","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71231","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hchq-288f-9hjc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71231.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71231","title":"IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie","description":"IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='\u003cdecoded lastLogin cookie\u003e' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.","status":"published","published":"2026-08-05T10:56:07.066Z","modified":"2026-08-10T11:45:27.796Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53304","description":"IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='\u003cdecoded lastLogin cookie\u003e' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.","status":"published","published":"2026-08-05T10:56:07Z","modified":"2026-08-10T11:45:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-hchq-288f-9hjc","title":"IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT *...","description":"IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID='\u003cdecoded lastLogin cookie\u003e' after base64-decoding the client-supplied lastLogin cookie via safe_decode(), which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. An unauthenticated attacker can set a lastLogin cookie containing a base64-encoded SQL injection payload (e.g. base64(\"' OR '1'='1\")) to bypass authentication and, via UNION-based injection, extract arbitrary data including user credentials.","status":"published","published":"2026-08-05T12:31:30Z","modified":"2026-08-05T12:31:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-71231","description":"IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='\u003cdecoded lastLogin cookie\u003e' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.","status":"published","published":"2026-08-05T11:16:25.74Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-71231","title":"IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie","description":"IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='\u003cdecoded lastLogin cookie\u003e' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.","status":"published","published":"2026-08-05T10:56:07.066Z","modified":"2026-11-11T02:30:33.773077159Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-11T11:06:51.232479Z"}]}}