The vulnerability exists in the POST /userlogin route of Miantang IoT-PHP's index.php, where the password from $_POST['pwd'] is used unsanitized in a raw SQL query. While the username is passed through htmlspecialchars(), it does not encode single quotes, leaving the password field vulnerable to SQL injection. An attacker can exploit this by submitting crafted payloads such as pwd=' OR '1'='1 to bypass authentication and perform UNION-based SQL injection to retrieve arbitrary data from the database.

An unauthenticated attacker can bypass authentication controls, gaining unauthorized access. Additionally, the attacker can extract arbitrary data from the backend database, potentially exposing sensitive information. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS score of 9.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the vulnerable endpoint or implement input validation and parameterized queries to prevent SQL injection.