CVE-2026-71237
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Miantang/IoT-PHP, in index.php, the POST /userlogin route reads the password directly from ['pwd'] without sanitization and concatenates it into a raw SQL string. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.
Risk Assessment
An attacker can gain unauthorized access to the system and steal sensitive data from the database, potentially leading to confidentiality and integrity breaches.
Recommendation
Immediately use parameterized SQL queries and input validation in the /userlogin route handler. Also, restrict the database account privileges used by the application.
Original NVD description (English source)
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.