{"api_version":"1","generated_at":"2026-08-07T13:39:18+00:00","cve":"CVE-2026-71237","urls":{"html":"https://cve.report/CVE-2026-71237","api":"https://cve.report/api/cve/CVE-2026-71237.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-71237","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-71237"},"summary":{"title":"Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin","description":"Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query(\"select * from userlists where username='$username' and password='$password' limit 1\"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.","state":"PUBLISHED","assigner":"TuranSec","published_at":"2026-08-05 11:16:26","updated_at":"2026-08-05 13:24:48"},"problem_types":["CWE-89","CWE-89 CWE-89 SQL Injection"],"metrics":[{"version":"3.1","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/Miantang/IoT-PHP","name":"https://github.com/Miantang/IoT-PHP","refsource":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71237","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71237","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Miantang","product":"IoT-PHP","version":"affected","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Mirdavlatov Mira'zam","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"71237","cve":"CVE-2026-71237","epss":"0.003390000","percentile":"0.264640000","score_date":"2026-08-06","updated_at":"2026-08-07 00:14:19"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-71237","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-05T12:46:46.300170Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-05T12:48:00.140Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"IoT-PHP","programFiles":["index.php"],"vendor":"Miantang","versions":[{"status":"affected","version":"0"}]}],"credits":[{"lang":"en","type":"finder","value":"Mirdavlatov Mira'zam"}],"descriptions":[{"lang":"en","value":"Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query(\"select * from userlists where username='$username' and password='$password' limit 1\"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 SQL Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-05T10:56:31.037Z","orgId":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","shortName":"TuranSec"},"references":[{"url":"https://github.com/Miantang/IoT-PHP"}],"title":"Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin"}},"cveMetadata":{"assignerOrgId":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","assignerShortName":"TuranSec","cveId":"CVE-2026-71237","datePublished":"2026-08-05T10:56:31.037Z","dateReserved":"2026-08-05T10:53:53.175Z","dateUpdated":"2026-08-05T12:48:00.140Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-05 11:16:26","lastModifiedDate":"2026-08-05 13:24:48","problem_types":["CWE-89","CWE-89 CWE-89 SQL Injection"],"metrics":{"cvssMetricV31":[{"source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-05T12:46:46.300170Z","id":"CVE-2026-71237","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"71237","Ordinal":"1","Title":"Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin","CVE":"CVE-2026-71237","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"71237","Ordinal":"1","NoteData":"Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query(\"select * from userlists where username='$username' and password='$password' limit 1\"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.","Type":"Description","Title":"Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin"}]}}}