CVE-2026-71231

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71231", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T10:53:53.175Z", "datePublished": "2026-08-05T10:56:07.066Z", "dateUpdated": "2026-08-10T11:45:27.796Z"}, "containers": {"cna": {"title": "IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie", "descriptions": [{"lang": "en", "value": "IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 SQL Injection", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "thebradleysanders", "product": "IOTSmartHome", "programFiles": ["gui/login.php"], "versions": [{"version": "0", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/thebradleysanders/IOTSmartHome", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Mirdavlatov Mira'zam", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:27.796Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T10:56:07.066Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T12:52:43.515445Z", "id": "CVE-2026-71231", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:52:53.954Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71231", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T12:52:43.515445Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:52:49.815Z"}}], "cna": {"title": "IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Mirdavlatov Mira'zam"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "thebradleysanders", "product": "IOTSmartHome", "versions": [{"status": "affected", "version": "0"}], "programFiles": ["gui/login.php"], "defaultStatus": "unknown"}], "datePublic": "2026-08-05T10:56:07.066Z", "references": [{"url": "https://github.com/thebradleysanders/IOTSmartHome", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.", "supportingMedia": [{"type": "text/html", "value": "<p>IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 SQL Injection"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:27.796Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71231", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:45:27.796Z", "dateReserved": "2026-08-05T10:53:53.175Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T10:56:07.066Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "IOTSmartHome", "programFiles": ["gui/login.php"], "vendor": "thebradleysanders", "versions": [{"status": "affected", "version": "0"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string."}, {"lang": "es", "value": "La funci\u00f3n checkCookie() de gui/login.php de IOTSmartHome construye una consulta de autenticaci\u00f3n como SELECT * FROM users WHERE ID=\u2019menor quecookie lastLogin decodificadamayor que\u2019 despu\u00e9s de decodificar en base64 la cookie lastLogin proporcionada por el cliente a trav\u00e9s de safe_decode(), que realiza una decodificaci\u00f3n base64 segura para URL sin sanitizaci\u00f3n del valor decodificado antes de que se concatene en la cadena SQL. Un atacante no autenticado puede establecer una cookie lastLogin que contenga una carga \u00fatil de inyecci\u00f3n SQL codificada en base64 (por ejemplo, base64(\u201c [expresi\u00f3n_SQLi_PoC] \u201d)) para eludir la autenticaci\u00f3n y, a trav\u00e9s de una inyecci\u00f3n basada en UNION, extraer datos arbitrarios incluyendo credenciales de usuario."}], "id": "CVE-2026-71231", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71231", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T12:52:43.515445Z", "version": "2.0.3"}}]}, "published": "2026-08-05T11:16:25.740", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/thebradleysanders/IOTSmartHome"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "IOTSmartHome", "source": "cna", "vendor": "thebradleysanders"}, "product": "iotsmarthome", "vendor": "thebradleysanders"}], "created": "2026-08-05T13:00:16.357211+00:00", "updated": "2026-08-10T22:30:06.630051+00:00", "vendors": ["thebradleysanders", "thebradleysanders$PRODUCT$iotsmarthome"]}