CVE-2026-71237
Received Received - Intake

SQL Injection in Miantang IoT-PHP

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='$username' and password='$password' limit 1"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71237
EUVD
EUVD-2026-53310

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miantang iot-php *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in Miantang/IoT-PHP's index.php file. The application directly concatenates user-supplied password input into a raw SQL query without sanitization. The username field uses htmlspecialchars() which fails to block single quotes, allowing attackers to inject malicious SQL payloads via the password parameter. An attacker can bypass authentication by submitting a payload like ' OR '1'='1 and extract arbitrary database data through UNION-based injection.

Detection Guidance

Check for POST requests to /userlogin with SQL injection payloads like pwd=' OR '1'='1. Inspect PHP files for unsanitized $_POST['pwd'] usage in raw SQL queries. Look for mysql_query() calls concatenating user input directly into SQL strings.

Impact Analysis

An unauthenticated attacker could gain full access to the application by bypassing login. They could extract sensitive data like user credentials, IoT device configurations, or personal information stored in the database. Attackers might also manipulate or delete data, leading to system compromise or disruption of IoT device controls.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. GDPR mandates strict data security measures and breach notification, while HIPAA requires safeguards for protected health information. The flaw could lead to unauthorized data exposure, resulting in regulatory penalties and legal consequences.

Mitigation Strategies

Replace mysql_query() with prepared statements using PDO or MySQLi. Sanitize all user inputs with functions like mysqli_real_escape_string(). Disable the abandoned project if possible and migrate to a maintained alternative.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart