CVE-2026-71231

{
  "id": "CVE-2026-71231",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-05T11:16:25.740",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string."
    },
    {
      "lang": "es",
      "value": "La función checkCookie() de gui/login.php de IOTSmartHome construye una consulta de autenticación como SELECT * FROM users WHERE ID=’menor quecookie lastLogin decodificadamayor que’ después de decodificar en base64 la cookie lastLogin proporcionada por el cliente a través de safe_decode(), que realiza una decodificación base64 segura para URL sin sanitización del valor decodificado antes de que se concatene en la cadena SQL. Un atacante no autenticado puede establecer una cookie lastLogin que contenga una carga útil de inyección SQL codificada en base64 (por ejemplo, base64(“ [expresión_SQLi_PoC] ”)) para eludir la autenticación y, a través de una inyección basada en UNION, extraer datos arbitrarios incluyendo credenciales de usuario."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "thebradleysanders",
          "product": "IOTSmartHome",
          "defaultStatus": "unknown",
          "programFiles": [
            "gui/login.php"
          ],
          "versions": [
            {
              "version": "0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T12:52:43.515445Z",
          "id": "CVE-2026-71231",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/thebradleysanders/IOTSmartHome",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}