Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it int…

CVE-2026-71237 affects Miantang/IoT-PHP, a PHP-based IoT application. The vulnerability exists in index.php's POST /userlogin route, where the password field ($_POST['pwd']) is directly concatenated into a raw SQL query without sanitization. While the username is passed through htmlspecialchars(), this function does not encode single quotes by default and therefore does not prevent SQL injection via the password field. An unauthenticated attacker can exploit this by submitting payloads such as pwd=' OR '1'='1 to bypass authentication entirely. Furthermore, UNION-based SQL injection can be leveraged to extract arbitrary data from the underlying database. The use of the deprecated mysql_query() function further compounds the security risk. No authentication is required to exploit this vulnerability, making it immediately accessible to remote attackers.