Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Miantang |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://github.com/Miantang/IoT-PHP |
|
History
Mon, 10 Aug 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='$username' and password='$password' limit 1"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database. | Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database. |
Mon, 10 Aug 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin | Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin |
Fri, 07 Aug 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Miantang
Miantang iot-php |
|
| Vendors & Products |
Miantang
Miantang iot-php |
Wed, 05 Aug 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 05 Aug 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='$username' and password='$password' limit 1"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database. | |
| Title | Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin | |
| Weaknesses | CWE-89 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published: 2026-08-05T10:56:31.037Z
Updated: 2026-08-10T11:45:40.322Z
Reserved: 2026-08-05T10:53:53.175Z
Link: CVE-2026-71237
Vulnrichment
Updated: 2026-08-05T12:47:40.506Z
NVD
Status : Deferred
Published: 2026-08-05T11:16:26.503
Modified: 2026-08-26T17:13:24.800
Link: CVE-2026-71237
Redhat
No data.