What is CVE-2026-71237?
The index.php file in the Miantang/IoT-PHP project has a POST /userlogin route that directly concatenates unsanitized password input into a raw SQL query. This leads to an SQL injection vulnerability allowing authentication bypass. Application owners should sanitize input by using parameterized queries for database operations.
Azərbaycanca: Miantang/IoT-PHP layihəsinin index.php faylında POST /userlogin marşrutu parolu birbaşa SQL sorğusuna sanitizasiya etmədən birləşdirir. Bu, autentifikasiya mexanizmini yan keçməyə imkan verən SQL injection zəifliyinə səbəb olur. Tətbiq sahibləri məlumat bazası sorğularında parametrləşdirilmiş sorğulardan (prepared statements) istifadə edərək daxiletmələri təmizləməlidir.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
Where does the SQL injection vulnerability exist in the Miantang/IoT-PHP project?
The vulnerability exists in the POST /userlogin route in the index.php file, where the password is directly concatenated into the SQL query without sanitization.
What measure should be taken to mitigate CVE-2026-71237?
Application owners should sanitize input by using parameterized queries for database operations.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.