Miantang IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from the 'pwd' POST parameter without any sanitization. This value is concatenated into a raw SQL query string executed by mysql_query, enabling an attacker to inject SQL code. An attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and use UNION-based SQL injection to extract arbitrary data from the database. The vulnerability is identified as CWE-89 (SQL Injection) and has a CVSS 3.1 score of 9.8, indicating critical severity. No patch or official remediation is currently documented.

An unauthenticated attacker can bypass authentication controls and gain unauthorized access. Additionally, the attacker can perform UNION-based SQL injection to extract arbitrary data from the backend database, potentially exposing sensitive information and compromising confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to implement input validation and parameterized queries to prevent SQL injection. Avoid direct concatenation of user input into SQL statements.