An unauthenticated SQL injection vulnerability in Jettweb Hazir Rent A Car Script V2 allows remote attackers to manipulate database queries and potentially extract sensitive data.

This is an SQL injection flaw (CWE-89) occurring within the arac_kategori_id parameter of the application. An unauthenticated attacker can supply malicious SQL payloads via POST requests to the affected endpoint to interact with the backend database.

The vulnerability poses a severe risk to data confidentiality and integrity, as successful exploitation enables unauthorized access to the underlying database. Given the CVSS score of 8.2, this is a high-severity issue that could lead to the exposure of customer information or administrative credentials. Organizations relying on this script for business operations may face significant reputational damage and regulatory non-compliance if data exfiltration occurs.

Immediate Action: As no official vendor patch is currently available, organizations should restrict external access to the affected script or disable the vulnerable module entirely.

Proactive Monitoring: Monitor web server logs for POST requests containing SQL syntax or unusual query patterns targeting the arac_kategori_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide effective virtual patching for this vulnerability.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the Exploit-DB entry (EDB-ID 46624).

Due to the lack of an official patch and the confirmed existence of public exploit code, this vulnerability presents a clear and present danger to affected environments. Administrators are urged to prioritize the implementation of WAF-based filtering or to rotate away from this legacy script if updates cannot be verified. Immediate action is required to prevent potential unauthorized database access.