SQL Injection in SmartHomeAdatum Login Component

A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users.php of the component Login. Such manipulation of the argument Login leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-15498 represents a critical authentication bypass vulnerability in the sergomanov SmartHomeAdatum platform, specifically within the users.php login component. An attacker can manipulate the Login argument to inject arbitrary SQL commands, potentially gaining unauthorized access to user accounts, extracting sensitive data, or modifying database records. This vulnerability has a CVSS score of 7.3 (High) and can be exploited remotely without authentication, making it particularly dangerous for organizations relying on SmartHomeAdatum for access control. The rolling-release nature of the product means affected deployments may be difficult to identify and patch systematically across distributed environments.

Casky's threat detection engine maps this attack chain to MITRE ATT&CK Initial Access (TA0001) and Persistence (TA0043) techniques, identifying 322 relevant security skills that detect exploitation patterns. Practitioners using Casky would observe detection signatures flagging suspicious SQL syntax in login parameter submissions, anomalous database query patterns originating from authentication endpoints, and unauthorized account creation or privilege escalation activities post-exploitation. Claude's extended reasoning capabilities enable the platform to correlate CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) indicators, recognizing the attack progression from initial injection attempt through post-compromise persistence mechanisms. Real-time alerting would surface malformed authentication requests, unusual database access from web-facing processes, and failed login attempts followed by successful privileged operations—the hallmark signature of SQL injection exploitation in login systems.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15498.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-15498

Casky has 322 skills that investigate the attack patterns behind CVE-2026-15498. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn