An unauthenticated SQL injection vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V3 poses a critical risk of unauthorized database access and potential data exfiltration.

The application fails to properly sanitize user input in the videoid parameter of the fonksiyonlar.php file. This allows unauthenticated attackers to execute arbitrary SQL commands via UNION-based injection techniques.

Successful exploitation of this vulnerability allows an attacker to bypass authentication and access sensitive information stored within the backend database. Given the high CVSS score of 8.2, this flaw presents a significant risk of data breach, potentially compromising user credentials, site content, and administrative configurations, leading to severe reputational damage and loss of system integrity.

Immediate Action: As no official patch is available for this legacy script, administrators should immediately restrict access to the affected script or migrate to a supported and secure content management platform.

Proactive Monitoring: Security teams should monitor web server logs for suspicious GET requests targeting fonksiyonlar.php, particularly those containing SQL syntax characters such as UNION, SELECT, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting attempts to manipulate the videoid parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the ExploitDB entry 46599.

Given the lack of vendor-supplied security updates and the ease with which this vulnerability can be exploited, immediate action is required to protect the environment. Organizations currently utilizing this script should prioritize migrating to a secure alternative, as the current codebase is demonstrably insecure and likely contains other unmitigated flaws.