The vulnerability arises because the checkCookie function in IOTSmartHome's gui/login.php decodes a client-supplied lastLogin cookie using a URL-safe base64 decode function (safe_decode) and then directly concatenates the decoded value into an SQL query string without any sanitization or parameterization. This leads to a classic SQL Injection (CWE-89) vulnerability, enabling an attacker to manipulate the SQL query executed against the users database. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with critical impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise depending on the database and application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to avoid using vulnerable versions or apply application-level mitigations such as input validation, parameterized queries, or web application firewalls that can detect and block SQL injection attempts.