The IOTSmartHome's gui/login.php checkCookie() function uses the client-supplied lastLogin cookie, which is base64-decoded without sanitization, to build an SQL query: SELECT * FROM users WHERE ID='<decoded lastLogin cookie>'. This allows an unauthenticated attacker to inject SQL code by crafting a base64-encoded payload (e.g., base64("' OR '1'='1")) in the lastLogin cookie. Exploitation can bypass authentication and perform UNION-based SQL injection to extract sensitive data including user credentials. The vulnerability is identified as CWE-89 (SQL Injection) and has a CVSS 3.1 score of 9.8, indicating critical severity.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls and extract arbitrary data from the backend database, including user credentials. This compromises confidentiality, integrity, and availability of the affected system, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable login interface to untrusted networks and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the lastLogin cookie parameter.