COMMAX Smart Home System SQL Injection Authentication Bypass Vulnerability

A SQL injection vulnerability has been identified in the COMMAX Smart Home System CDP-1020n. This vulnerability allows attackers to bypass authentication by injecting arbitrary SQL code through the 'id' parameter in 'loginstart.asp'. Exploitation involves sending a POST request with malicious 'id' values to manipulate database queries and gain unauthorized access.

Impact

Exploitation of this vulnerability allows for authentication bypass, unauthorized access to the system, and potential manipulation of database information.

Reproduction

To reproduce this vulnerability, send a POST request to 'loginstart.asp' with a crafted 'id' parameter that includes SQL injection payloads. The injection should exploit the application's SQL query handling to bypass authentication.