{"id":"CVE-2026-71231","published":"2026-08-05T11:16:25.740","lastModified":"2026-08-10T12:17:25.533","description":"IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/thebradleysanders/IOTSmartHome","tags":[]}],"exploitRefs":[{"url":"https://github.com/thebradleysanders/IOTSmartHome","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to execute arbitrary SQL commands by exploiting improper input sanitization in the authentication query construction.","exploitability":"Exploitation is relatively straightforward given access to the cookie value, making it a high-risk vulnerability.","blast_radius":"If exploited, this could lead to full database compromise and unauthorized access to user data.","remediation":"Implement proper input validation and sanitization for SQL queries, or use parameterized queries to prevent SQL injection.","tags":["rce","sql-injection","web","auth-bypass"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:43:12.616Z"}}