{"id":"CVE-2026-71237","published":"2026-08-05T11:16:26.503","lastModified":"2026-08-10T12:17:26.197","description":"Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query(\"select * from userlists where username='' and password='' limit 1\"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Miantang/IoT-PHP","tags":[]}],"exploitRefs":[{"url":"https://github.com/Miantang/IoT-PHP","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows unauthenticated attackers to bypass authentication and potentially extract database data through SQL injection.","exploitability":"Exploitation is relatively easy as it requires submitting a simple payload without any authentication needed.","blast_radius":"If exploited, the impact could be severe, allowing full access to sensitive data stored in the database.","remediation":"Sanitize user inputs and use parameterized queries or prepared statements to prevent SQL injection attacks.","tags":["rce","auth-bypass","web","sql-injection"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:43:16.450Z"}}