An unauthenticated SQL injection vulnerability in the Jettweb PHP Hazir Haber Sitesi Scripti V3 administration panel allows attackers to bypass authentication and gain full administrative control.

The application is susceptible to an authentication bypass vulnerability located in the login.php administration panel, caused by improper neutralization of SQL command elements. Unauthenticated attackers can exploit this flaw by entering crafted SQL syntax, specifically using equals signs and 'or' operators, into the username and password fields to bypass authentication entirely.

Successful exploitation of this vulnerability grants an attacker unauthorized administrative access to the application. This compromise can lead to complete loss of confidentiality and integrity, allowing the attacker to modify site content, access sensitive database information, or further compromise the underlying server infrastructure. Given the critical nature of administrative access, this vulnerability is classified as high severity.

Immediate Action: There is no official vendor patch available for this legacy script. Administrators should immediately restrict access to the administration directory at the network level or discontinue the use of this software.

Proactive Monitoring: Review web access logs for anomalous login attempts containing SQL syntax patterns, such as the use of 'or' operators or equals signs in authentication fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns targeting the login parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the Exploit Database (EDB-ID: 46599).

The severity of this vulnerability, combined with the lack of vendor-supplied patches, necessitates immediate action. Because this script is vulnerable to trivial authentication bypass, it should be considered unsafe for production environments. Organizations still utilizing this software must implement stringent network-level access controls or prioritize migrating to a secure, supported alternative to mitigate the risk of unauthorized administrative access.