EUVD-2026-53310
GHSA-wjx2-3579-9x87
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated injection via the default login endpoint (AV:N/AC:L/PR:N/UI:N); full DB read and auth bypass give high confidentiality, integrity, and availability impact.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
2DescriptionCVE.org
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='$username' and password='$password' limit 1"). The username value is passed through htmlspecialchars(), which does not encode single quotes by default and therefore does not prevent SQL injection through the password field. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.
AnalysisAI
Authentication bypass and database exfiltration in Miantang's IoT-PHP application via SQL injection in the login handler. The POST /userlogin route in index.php concatenates the unsanitized $_POST['pwd'] value directly into a MySQL query, letting an unauthenticated attacker log in as any user with a payload like pwd=' OR '1'='1 and use UNION-based injection to read arbitrary database contents. No public exploit identified at time of analysis, though the technique is trivial and well-documented; no EPSS or KEV data was supplied.
Technical ContextAI
IoT-PHP is a PHP web application backed by MySQL that uses the legacy mysql_query() API. The vulnerability is a textbook CWE-89 (SQL Injection) flaw: user input from the password field is interpolated into a raw SQL string - mysql_query("select * from userlists where username='$username' and password='$password' limit 1") - with no parameterization or escaping. Notably, the developer applied htmlspecialchars() to the username as a defense, but htmlspecialchars() without the ENT_QUOTES flag does not encode single quotes, so it provides no protection against SQL injection; the password field receives no filtering at all. Because the query returns a user row on a truthy WHERE clause, injection both bypasses authentication and, through UNION SELECT, allows extraction of any column from any accessible table.
RemediationAI
No vendor-released patch identified at time of analysis. The definitive fix is to replace the string-concatenated query with a parameterized prepared statement (PDO or mysqli with bound parameters) and to migrate off the deprecated mysql_query() API entirely; never rely on htmlspecialchars() for SQL safety, and if quote-encoding is desired ensure ENT_QUOTES is set (though this is not a substitute for parameterization). As immediate compensating controls until code can be fixed: restrict network access to the application (place it behind a VPN or IP allowlist so the /userlogin endpoint is not internet-exposed), and deploy a WAF rule to block SQL metacharacters in the pwd and username POST parameters - noting that WAF filtering can be bypassed and may break legitimate passwords containing special characters. Monitor the project repository at https://github.com/Miantang/IoT-PHP for an upstream fix commit.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today