TI-2026-49902 CVE-2026-71231 · GHSA-hchq-288f-9hjc
IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie
Priority MEDIUM 50
IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, wh…