A critical SQL injection vulnerability in Jettweb Hazir Haber Sitesi Scripti version 3.0 allows unauthenticated attackers to compromise sensitive database information and potentially bypass authentication.

This vulnerability is a classic SQL injection (CWE-89) flaw located in the application's handling of user-supplied input. An unauthenticated attacker can supply malicious payloads through the kelime POST parameter, or other vectors such as the videoid parameter, to interact directly with the backend database.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk of data exfiltration, unauthorized administrative access, and potential full system compromise. Given the CVSS score of 8.2, this vulnerability is considered high severity as it permits direct interaction with the database layer, which often contains sensitive user credentials and site content.

Immediate Action: As there is no official patch available for this legacy script, organizations should immediately restrict access to the application or migrate to a more secure and actively maintained alternative.

Proactive Monitoring: Security teams should monitor web server logs for irregular POST requests containing SQL keywords or UNION-based syntax targeting the kelime or videoid parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns specifically targeting the vulnerable parameters identified in the research documentation.

Public Exploit Available: Yes, a functional exploit is available via the Exploit-DB entry 46599.

Due to the absence of vendor-supplied patches and the availability of public exploits, this software represents a significant security liability. Organizations currently utilizing Jettweb Hazir Haber Sitesi Scripti V3 are strongly advised to decommission the software or implement strict network-level isolation to prevent unauthorized access.