An unauthenticated SQL injection vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V3 allows remote attackers to compromise the underlying database.

The application fails to properly sanitize the kelime POST parameter, allowing an unauthenticated attacker to inject malicious SQL commands. This flaw permits UNION-based SQL injection, enabling unauthorized data extraction or modification of the database contents.

Successful exploitation of this vulnerability can result in full unauthorized access to the application database, leading to the exfiltration of sensitive information or the integrity loss of news content. Given the CVSS score of 8.2, this represents a high-risk scenario for organizations relying on this script, as it facilitates complete database compromise without requiring authentication.

Immediate Action: As no official patch is currently available from the vendor, organizations should immediately restrict access to the affected script or implement input validation routines to sanitize the kelime parameter.

Proactive Monitoring: Security teams should monitor database logs for unusual query patterns, specifically those containing SQL keywords or UNION statements, and review web server access logs for anomalous POST requests to the kelimeara endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting POST parameters.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in Exploit-DB entry 46599.

Due to the high severity of this SQL injection vulnerability and the availability of public exploit code, it is imperative that users of Jettweb PHP Hazir Haber Sitesi Scripti V3 take immediate defensive action. If the software cannot be updated or patched, consider migrating to a more secure platform, as the lack of an official vendor fix leaves the application permanently exposed to trivial exploitation attempts.