Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-71237: Miantang IoT-PHP: Unauthenticated Password Bypass and Data Theft
CVE-2026-71237
CVE-2026-71237
Summary
Miantang IoT-PHP's login feature is vulnerable to unauthorized access. An attacker can bypass the login system and extract sensitive data from the database. To protect your system, update Miantang IoT-PHP to a secure version or patch the vulnerable code.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| miantang | iot-php | All versions |
Original title
Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin
Original description
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='$username' and password='$password' limit 1"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.
nvd CVSS3.1
9.8
Vulnerability type
CWE-89
SQL Injection
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026