Overview
An external security researcher reported a pre-authentication SQL injection in the web-GUI login endpoint (/login/check, username parameter) of our public demo unit at demounit.smseagle.eu. SMSEagle Team investigated the report and confirmed that the reported behaviour occurs only on the demo unit, which runs a separate legacy code branch. The vulnerable statement is a legacy validity check in the login lookup that interpolates the username value into the query string instead of using parameter binding.
The SMSEagle software distributed to customers is not affected. In the released product code the login lookup uses the framework query builder with parameter binding, and no raw string interpolation of request input is present in this code path.
Affected Products
None. No SMSEagle device model or released software version is affected. The issue was limited to the vendor-hosted demo appliance.
Remediation
No action is required by customers. The demo unit has been updated to remove the legacy code path.