CVE-2026-71237 PUBLISHED

Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin

Assigner: TuranSec
Reserved: 05.08.2026 Published: 05.08.2026 Updated: 05.08.2026

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='$username' and password='$password' limit 1"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Miantang
Product IoT-PHP
Versions Default: unknown
  • Version 0 is affected

Credits

  • Mirdavlatov Mira'zam finder

References

Problem Types

  • CWE-89 SQL Injection CWE