An unauthenticated SQL injection vulnerability in the PRO-7070 administrative login panel allows attackers to bypass authentication and gain unauthorized access to the system.

The application is vulnerable to SQL injection (CWE-89) within the administration panel login page. By entering specific SQL-related characters into the username and password fields, an unauthenticated attacker can manipulate database queries to bypass the login requirement.

Successful exploitation grants an attacker full access to the administrative interface of the web application. This could lead to complete system compromise, unauthorized modification of website content, theft of sensitive user data, and potential reputational damage. Given the CVSS score of 7.5, this is considered a high-severity risk that requires immediate attention to prevent unauthorized administrative control.

Immediate Action: As there is no official patch available from the vendor, users are strongly advised to restrict access to the administrative directory (e.g., /yonetim/) at the network or web server level. If the software is no longer supported, consider migrating to a secure, actively maintained alternative.

Proactive Monitoring: Review web server access logs for anomalous login attempts containing special characters such as single quotes and the word OR. Monitor for any unauthorized changes to the administrative user account settings or application configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to block malicious input patterns targeting the login form. Ensure the application is isolated from the public internet using VPN or IP-based access controls for administrative endpoints.

Public Exploit Available: Yes, a functional exploit is available via the Exploit-DB entry (EDB-ID 47758).

The severity of this vulnerability is significant due to the ease of exploitation and the level of access granted to an attacker. Administrators must prioritize restricting access to the administrative login portal immediately. Given the lack of a vendor-provided patch, users should evaluate the necessity of this software and implement robust compensating controls to mitigate the inherent risk of full administrative takeover.