An unauthenticated SQL injection vulnerability in Thrive Smart Home version 1.1 allows attackers to bypass authentication and gain unauthorized access to the application.

This is an SQL injection flaw (CWE-89) located in the checklogin.php endpoint. By injecting malicious SQL payloads into the user POST parameter, an unauthenticated attacker can manipulate the backend authentication query to bypass security controls.

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass the login mechanism entirely. This grants unauthorized access to the smart home management interface, which could result in the compromise of sensitive user data, unauthorized control over connected home devices, and potential lateral movement within the network. Given the CVSS score of 8.2, this vulnerability represents a high risk to operational security and user privacy.

Immediate Action: As there is no official vendor patch available, administrators should restrict network access to the management interface by placing it behind a VPN or firewall, ensuring it is not exposed to the public internet.

Proactive Monitoring: Review web server access logs for anomalous POST requests to checklogin.php, specifically searching for strings containing SQL syntax characters such as single quotes, double dashes, or common SQL injection keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists; specifically, a technical advisory and exploit code were documented by Zero Science Lab and published on Exploit-DB (EDB-ID 47814).

Due to the lack of a vendor-supplied patch, this vulnerability poses a persistent risk to any deployment of Thrive Smart Home version 1.1. Security teams must prioritize isolating the affected device from external networks and implementing strict WAF filtering to prevent unauthorized access until the software can be replaced or decommissioned.