A critical SQL injection vulnerability in IOTSmartHome allows unauthenticated attackers to bypass authentication and exfiltrate sensitive data from the underlying database.

This is an SQL Injection (CWE-89) vulnerability located in the checkCookie function within gui/login.php. The application fails to sanitize the decoded contents of the lastLogin cookie before concatenating it into a database query, enabling attackers to inject malicious SQL commands.

Successful exploitation allows an attacker to bypass authentication mechanisms, granting them unauthorized access to the application. Furthermore, the use of UNION-based injection allows for the extraction of sensitive information, including user credentials, which could lead to widespread account compromise and a severe breach of confidentiality.

Immediate Action: Update IOTSmartHome to the latest version immediately to receive the necessary input sanitization fixes. If an update is unavailable, disable the affected login functionality or restrict access to the web interface.

Proactive Monitoring: Monitor database logs for suspicious query patterns, such as unexpected UNION statements or syntax errors indicative of injection attempts. Review authentication logs for unusual login activity.

Compensating Controls: Utilize a WAF to inspect and block incoming HTTP requests containing suspicious base64-encoded payloads in the lastLogin cookie.

Public Exploit Available: false

Given the critical severity and the ease of exploitation, immediate remediation is required. Ensure that all database interactions are parameterized and that input validation is strictly enforced to prevent further injection risks.