CVE-2026-71237

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Published

2026-08-05

Last modified

2026-08-10

Weaknesses

CWE-89

Affected products

• Iot-php (Miantang)

References

• https://github.com/Miantang/IoT-PHP