CVE-2026-71231

Descripción

IOTSmartHome-s gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID=-<decoded lastLogin cookie>- after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.