Technical impact
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query('select * from userlists where username='' and password='' limit 1'). This represents a CWE-89 SQL Injection vulnerability. An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.
Affected Systems
Miantang:IoT-PHP – all versions containing the index.php login handler. No specific version numbers are listed in the CNA data, so all deployments with this functionality are considered vulnerable.
Risk and Exploitability
The score of 9.8 on the CVSS scale indicates critical severity, and the EPSS score of <1% indicates a low, but nonzero probability of exploitation. The lack of any KEV listing does not mitigate the high risk. An attacker can exploit the flaw from any network location that can reach the /userlogin endpoint, requiring only a basic HTTP POST. Successful exploitation grants the attacker full read access to the user database and, with UNION-based injection, arbitrary data extraction.
