A critical authentication bypass vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V2 allows unauthenticated attackers to gain full administrative control of the application.

The application fails to properly neutralize special characters in the username and password fields of the admingiris.php login form, which facilitates a SQL injection attack. This flaw allows an unauthenticated attacker to manipulate database queries to bypass authentication mechanisms and access the administrative panel.

The ability for an unauthenticated user to bypass authentication and gain administrative access represents a complete compromise of the application's security. With administrative privileges, an attacker could potentially modify site content, exfiltrate sensitive data, or inject malicious code into the web environment. Given the CVSS score of 8.2, this vulnerability poses a high risk to organizational data integrity and operational continuity.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /yonetim/ directory using IP allowlisting or additional authentication layers at the web server level.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the admingiris.php file, particularly those containing SQL syntax characters like single quotes or equality operators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting login parameters.

Public Exploit Available: Yes, a published proof-of-concept exists on Exploit-DB (EDB-ID: 46598).

Given the ease of exploitation and the critical nature of an authentication bypass, immediate mitigation is required. Organizations using Jettweb PHP Hazir Haber Sitesi Scripti V2 should prioritize restricting administrative access to trusted networks or disabling the vulnerable script until a security patch is provided by the vendor. Failure to apply these controls leaves the application exposed to unauthorized administrative takeover.