An unauthenticated SQL injection vulnerability in Jettweb Php Hazir Ilan Sitesi Scripti V2 allows remote attackers to compromise the backend database and extract sensitive data.

The application fails to properly sanitize user input within the kat parameter of the katgetir.php script, which allows unauthenticated attackers to inject malicious SQL commands directly into the database query.

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in the exfiltration of sensitive user information, administrative credentials, or proprietary site content. Given the CVSS score of 8.2, this vulnerability represents a high risk to data confidentiality, which may result in significant reputational damage and regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the affected script, katgetir.php, via web server configuration or immediately discontinue the use of the legacy software.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous GET requests targeting the katgetir.php file, specifically looking for SQL syntax patterns such as single quotes, UNION statements, or comment characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the kat parameter.

Public Exploit Available: Yes — a published proof-of-concept exists and is documented in the Exploit Database (EDB-ID: 46606).

Due to the lack of a vendor-provided patch and the availability of a public exploit, this software should be considered end-of-life and inherently insecure. Organizations still utilizing this script must migrate to a secure alternative immediately or isolate the system from the network to prevent unauthorized database access.