CVE-2026-71237: Miantang IoT-PHP SQL Injection Vulnerability

CVE-2026-71237 Overview

CVE-2026-71237 is a SQL injection vulnerability [CWE-89] in the Miantang/IoT-PHP application. The flaw resides in the POST /userlogin route defined in index.php. The application reads the pwd parameter directly from $_POST and concatenates it into a raw SQL query without sanitization or parameterization. An unauthenticated remote attacker can inject SQL through the password field, bypass authentication, and extract arbitrary data using UNION-based techniques.

Critical Impact
Unauthenticated attackers can bypass login and exfiltrate database contents by injecting SQL through the pwd POST parameter.

Affected Products

Miantang/IoT-PHP (index.php/userlogin route)
All versions of the application prior to a patched release
Deployments exposing the login endpoint over the network

Discovery Timeline

2026-08-05 - CVE-2026-71237 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71237

Vulnerability Analysis

The /userlogin handler in index.php accepts credentials via HTTP POST. The application passes $_POST['username'] through htmlspecialchars() but reads $_POST['pwd'] with no filtering. Both values are then interpolated directly into a raw SQL statement executed with the deprecated mysql_query() API.

The resulting query has the structure select * from userlists where username='$username' and password='$password' limit 1. Because the password value is embedded unquoted-safe into the SQL string, an attacker controls the query's logic. This grants full read access to the userlists table and, through UNION selects, any other table in the connected database.

Exploitation requires no authentication, no user interaction, and low attack complexity, since only a single crafted HTTP request to the public login endpoint is needed.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. htmlspecialchars() on $username does not encode single quotes by default (the ENT_QUOTES flag is not set) and is not a SQL sanitizer regardless. The pwd field receives no encoding at all. The code path relies on string concatenation rather than prepared statements or parameter binding.

Attack Vector

An attacker sends an HTTP POST request to /userlogin with a malicious pwd value such as ' OR '1'='1. The injected clause makes the WHERE predicate always evaluate true, returning the first row from userlists and authenticating the attacker as that user. A UNION-based payload appended to pwd extracts data from arbitrary tables. See the GitHub IoT-PHP Repository for the vulnerable source.

No verified exploit code is published; the vulnerability mechanism is described in prose because no realCodeExamples were provided.

Detection Methods for CVE-2026-71237

Indicators of Compromise

HTTP POST requests to /userlogin containing SQL metacharacters such as single quotes, OR, UNION, SELECT, or -- in the pwd parameter.
Successful authentications from source IPs that never completed a normal login flow or that authenticate as multiple distinct users in rapid succession.
Application or database error responses referencing MySQL syntax errors originating from the login endpoint.

Detection Strategies

Deploy a web application firewall rule to inspect the pwd POST parameter for SQL injection signatures before it reaches the application.
Enable MySQL general query logging and alert on select * from userlists statements containing tautologies like '1'='1' or UNION SELECT.
Correlate web server access logs with database query logs to identify anomalous query shapes tied to /userlogin requests.

Monitoring Recommendations

Monitor for spikes in POST volume or error rates against the login endpoint.
Track outbound data volume from the database host to detect UNION-based data exfiltration.
Alert on repeated login successes for the same account from geographically diverse IPs within short windows.

How to Mitigate CVE-2026-71237

Immediate Actions Required

Restrict network access to the /userlogin endpoint to trusted sources until a code fix is applied.
Rewrite the query in index.php to use mysqli or PDO prepared statements with bound parameters for both username and pwd.
Rotate credentials for any account stored in the userlists table if exposure is suspected.

Patch Information

No vendor patch is referenced in the CVE record. Operators should apply source-level fixes directly against the code available at the GitHub IoT-PHP Repository, replace the deprecated mysql_* functions with a parameterized database API, and hash stored passwords instead of comparing plaintext.

Workarounds

Place the application behind a WAF configured to block SQL injection patterns in POST bodies targeting /userlogin.
Validate that pwd matches an expected character set (for example, printable ASCII without quotes or semicolons) before it reaches the SQL layer.
Apply least-privilege database credentials so the web user cannot read tables outside userlists, limiting UNION-based extraction.

bash

# Example WAF rule (ModSecurity) blocking SQLi in the pwd parameter
SecRule ARGS:pwd "@rx (?i)(\bunion\b.*\bselect\b|'\s*or\s*'?\d+'?\s*=\s*'?\d+|--|/\*)" \
    "id:1002026,phase:2,deny,status:403,\
    msg:'SQL Injection attempt in pwd parameter (CVE-2026-71237)',\
    tag:'CWE-89'"