SQL injection in the /userlogin route allows an attacker to bypass authentication and extract database contents. The vulnerability stems from directly concatenating the password, retrieved from POST data, into a SQL query without sanitization. By submitting a payload like pwd=' or '1'='1, an unauthenticated user can gain arbitrary data access and potentially employ UNION-based injections to read any table.

Miantang:IoT-PHP – all versions containing the index.php login handler. No specific version numbers are listed in the CNA data, so all deployments with this functionality are considered vulnerable.

The score of 9.8 on the CVSS scale indicates critical severity, and although EPSS is not provided, the lack of any KEV listing does not mitigate the high risk. An attacker can exploit the flaw from any network location that can reach the /userlogin endpoint, requiring only a basic HTTP POST. Successful exploitation grants the attacker full read access to the user database and, with UNION-based injection, arbitrary data extraction.