The Jettweb PHP Hazir Haber Sitesi Scripti V1 contains a critical SQL injection vulnerability that allows unauthenticated attackers to compromise the underlying database.

The application fails to properly sanitize user-supplied input in the cid parameter of the haberarsiv.php file. This flaw permits unauthenticated attackers to perform UNION-based SQL injection attacks to read or modify database contents.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information stored within the application database, potentially resulting in full data exfiltration. Given the CVSS score of 8.2, this vulnerability represents a high risk to the confidentiality and integrity of business data, which may result in significant reputational damage or regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the affected script or transition to a secure, supported alternative.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax, such as UNION, SELECT, or OR statements, targeting the haberarsiv.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns in incoming HTTP requests.

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit-DB entry 46597.

The severity of this SQL injection vulnerability necessitates immediate attention. Because the software is potentially unmaintained, organizations using this script should prioritize migrating to a secure platform. If migration is not immediately feasible, implement strict WAF filtering and limit network exposure to the vulnerable application to mitigate the risk of exploitation.