CVE-2026-71231: IOTSmartHome SQL Injection Vulnerability

CVE-2026-71231 Overview

CVE-2026-71231 is a SQL injection vulnerability in the IOTSmartHome project's gui/login.php script. The checkCookie() function base64-decodes a client-supplied lastLogin cookie via safe_decode() and concatenates the result directly into a SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' query. No sanitization occurs between decoding and query construction. An unauthenticated attacker can supply a base64-encoded SQL payload in the lastLogin cookie to bypass authentication and extract arbitrary database contents through UNION-based injection, including stored user credentials. The flaw is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated remote attackers can bypass authentication and exfiltrate stored credentials from the IOTSmartHome database.

Affected Products

IOTSmartHome project (thebradleysanders/IOTSmartHome on GitHub)
gui/login.php component invoking checkCookie()
Deployments relying on safe_decode() for cookie handling

Discovery Timeline

2026-08-05 - CVE-2026-71231 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71231

Vulnerability Analysis

The vulnerability resides in the cookie-based authentication path of IOTSmartHome. When a client sends a lastLogin cookie, checkCookie() calls safe_decode(), which performs URL-safe base64 decoding. The decoded string is then interpolated directly into a SQL statement: SELECT * FROM users WHERE ID='<decoded value>'. Because base64 decoding is not a security function, an attacker controls the resulting bytes fully. Any SQL metacharacters produced after decoding are passed to the database driver unescaped.

An attacker submits lastLogin set to base64("' OR '1'='1"). After decoding, the query becomes SELECT * FROM users WHERE ID='' OR '1'='1', which returns a row and authenticates the session. The same primitive supports UNION-based extraction: a payload such as base64("' UNION SELECT username,password,... FROM users-- ") retrieves credential hashes and other columns. Exploitation requires no privileges and no user interaction.

Root Cause

The root cause is missing input sanitization on decoded cookie data before its use in a dynamic SQL query. The developer treated base64 decoding as a validation step, but base64 is a reversible encoding, not a sanitizer. Parameterized queries or an allow-list on the decoded ID value would have prevented the flaw.

Attack Vector

The attack vector is network-based over HTTP(S). An unauthenticated attacker sends a single request to gui/login.php with a crafted lastLogin cookie. The application decodes the cookie, executes the tainted query, and returns authentication state or injected result data. No configuration change on the server is required for exploitation.

See the IOTSmartHome GitHub repository for the vulnerable source code and function definitions.

Detection Methods for CVE-2026-71231

Indicators of Compromise

HTTP requests to gui/login.php containing a lastLogin cookie whose base64-decoded value includes SQL metacharacters such as ', --, UNION, or OR '1'='1'.
Web server or database logs showing SELECT * FROM users WHERE ID='...' statements with tautologies or UNION SELECT clauses.
Successful authentications with no preceding POST to the login form.
Unusual outbound traffic or large response payloads from login.php responses.

Detection Strategies

Decode inbound lastLogin cookie values in a WAF or reverse proxy and inspect for SQL syntax before the request reaches PHP.
Enable MySQL general query logging or use a database activity monitor to flag WHERE ID= clauses containing boolean tautologies or UNION.
Correlate authentication success events with the absence of a matching POST /login submission for the same session.

Monitoring Recommendations

Alert on repeated 200 responses from login.php originating from a single source IP within a short window.
Monitor for HTTP requests whose Cookie header decodes to non-printable or SQL-like content.
Track database error rates on the users table, since blind and error-based injection variants often generate syntax exceptions.

How to Mitigate CVE-2026-71231

Immediate Actions Required

Remove the IOTSmartHome application from untrusted networks until the login path is fixed.
Rotate all stored user credentials and any secrets accessible via the users table.
Invalidate existing sessions and force re-authentication once a fix is deployed.
Deploy WAF rules that reject lastLogin cookies whose decoded content contains SQL metacharacters.

Patch Information

No official vendor patch is referenced in the NVD entry at time of publication. Operators should replace the vulnerable query in checkCookie() with a parameterized statement using PDO prepared statements or mysqli_prepare() with bound parameters, and validate that the decoded ID value matches an expected format (for example, numeric or UUID) before use. Monitor the IOTSmartHome GitHub repository for upstream fixes.

Workarounds

Disable cookie-based session resumption in gui/login.php and require full form authentication.
Add a server-side allow-list check that rejects any decoded lastLogin value not matching ^[A-Za-z0-9_-]+$.
Front the application with a WAF rule that blocks requests where base64_decode(lastLogin) contains ', ", ;, --, or the keyword UNION.
Restrict database account privileges used by the web application to the minimum required for authentication queries.

bash

# Example ModSecurity rule blocking SQL metacharacters in decoded lastLogin cookie
SecRule REQUEST_COOKIES:lastLogin "@rx .+" \
    "id:1002026712,phase:1,deny,status:403,t:none,t:urlDecode,t:base64Decode,\
    chain,msg:'CVE-2026-71231 IOTSmartHome lastLogin SQLi attempt'"
    SecRule TX:0 "@rx (?i)(union\s+select|or\s+'1'='1|--|';)"