An unauthenticated SQL injection vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V1 allows attackers to extract sensitive database information or modify records.

The application fails to properly sanitize user input in the poll parameter of the arama.php script. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information stored in the application database, including user credentials or site configuration data. Given the CVSS score of 8.2, this represents a high-severity risk that could result in complete data compromise or integrity loss. Furthermore, the ability to modify database contents may allow an attacker to gain administrative control over the application.

Immediate Action: As no official vendor patch is available, immediately restrict access to the vulnerable arama.php endpoint or disable the affected poll functionality entirely.

Proactive Monitoring: Review database query logs for unusual syntax, such as UNION SELECT statements or unexpected sleep commands, which are common indicators of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious SQL injection patterns directed at the arama.php file.

Public Exploit Available: Yes, a published proof-of-concept exploit exists and is documented in the Exploit-DB entry 46597.

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate action. Organizations utilizing this script should prioritize migrating to a secure alternative or removing the affected component if a patch is not provided by the vendor. Ensure that database permissions are restricted to the minimum required level to limit the potential impact of an injection attack.