A critical SQL injection vulnerability in Jettweb Hazir Rent A Car Scripti V4 allows unauthenticated attackers to compromise database integrity and extract sensitive information.

The application fails to properly sanitize user-supplied input in the tur, id, and ozellikdil GET parameters within the admin/index.php endpoint. This allows an unauthenticated attacker to execute arbitrary SQL commands against the underlying database.

Successful exploitation allows an unauthorized party to bypass application logic, extract sensitive customer or administrative data, and potentially cause a denial of service. With a CVSS score of 8.2, this vulnerability represents a high risk to business operations and data confidentiality.

Immediate Action: As no official vendor patch is available, organizations should isolate the affected application from public networks or remove it from production environments entirely.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SLEEP, or XOR operators, targeted at the admin/index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting the identified vulnerable parameters before they reach the application.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the Exploit-DB entry 46614.

Given the lack of a vendor-provided patch and the availability of public exploit code, this software must be considered insecure for production use. Administrators should migrate to a supported and secure alternative or restrict access to the affected script to trusted internal networks only until a permanent resolution is implemented.