An unauthenticated SQL injection vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V3 exposes the application to unauthorized database access and potential authentication bypass.

The application fails to properly sanitize user input in the 'q' parameter within the datagetir.php file. This allows unauthenticated attackers to perform time-based blind SQL injection attacks to exfiltrate database contents or bypass administrative authentication.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to sensitive information stored within the backend database. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to full compromise of the application data, reputational damage, and potential regulatory non-compliance regarding data privacy.

Immediate Action: As no official vendor patch is available, administrators should immediately restrict access to the affected script or disable the vulnerable functionality until a secure update is provided.

Proactive Monitoring: Security teams should monitor web server logs for anomalous GET requests to datagetir.php, specifically looking for SQL syntax patterns or time-delay functions in the 'q' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the 'q' parameter and other identified vulnerable endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the Exploit-DB entry 46599.

Due to the high severity and the availability of public exploit code, this vulnerability poses a significant risk to the integrity of the application. Organizations utilizing Jettweb PHP Hazir Haber Sitesi Scripti V3 must prioritize isolating the affected component and implementing robust WAF filtering to prevent unauthorized database manipulation. Given the lack of a vendor-provided patch, migration to a more secure and actively maintained platform is strongly advised.