{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71237", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T10:53:53.175Z", "datePublished": "2026-08-05T10:56:31.037Z", "dateUpdated": "2026-08-05T12:48:00.140Z"}, "containers": {"cna": {"title": "Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin", "descriptions": [{"lang": "en", "value": "Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query(\"select * from userlists where username='$username' and password='$password' limit 1\"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 SQL Injection", "cweId": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Miantang", "product": "IoT-PHP", "programFiles": ["index.php"], "versions": [{"version": "0", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "references": [{"url": "https://github.com/Miantang/IoT-PHP"}], "credits": [{"lang": "en", "value": "Mirdavlatov Mira'zam", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-05T10:56:31.037Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T12:46:46.300170Z", "id": "CVE-2026-71237", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:48:00.140Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71237", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T12:46:46.300170Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T12:47:40.506Z"}}], "cna": {"title": "Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin", "credits": [{"lang": "en", "type": "finder", "value": "Mirdavlatov Mira'zam"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Miantang", "product": "IoT-PHP", "versions": [{"status": "affected", "version": "0"}], "programFiles": ["index.php"], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/Miantang/IoT-PHP"}], "descriptions": [{"lang": "en", "value": "Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query(\"select * from userlists where username='$username' and password='$password' limit 1\"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 SQL Injection"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-05T10:56:31.037Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71237", "state": "PUBLISHED", "dateUpdated": "2026-08-05T12:48:00.140Z", "dateReserved": "2026-08-05T10:53:53.175Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T10:56:31.037Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{}

{}

{"created": "2026-08-05T12:30:12.419588+00:00", "updated": "2026-08-05T12:30:12.419593+00:00", "vendors": []}