A critical SQL injection vulnerability in Jettweb PHP Hazir Haber Sitesi Scripti V1 allows unauthenticated remote attackers to compromise database integrity and confidentiality.

The application fails to properly sanitize input within the option parameter of the uyelik.php script. This flaw allows an unauthenticated attacker to inject malicious SQL commands, facilitating time-based data extraction or unauthorized administrative access.

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, which may contain sensitive user credentials, administrative configurations, or proprietary content. Given the CVSS score of 8.2, this represents a significant risk to data confidentiality and application integrity, potentially leading to total system compromise or regulatory non-compliance.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the application or migrate to a more secure platform.

Proactive Monitoring: Monitor web server logs for suspicious POST requests targeting uyelik.php, specifically identifying patterns consistent with SQL injection payloads, such as time-based sleep commands or UNION SELECT statements.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect incoming traffic and block requests containing malicious SQL syntax before they reach the application.

Public Exploit Available: Yes, a functional exploit is available via the Exploit Database (EDB-ID 46597).

The presence of a publicly available exploit for this SQL injection vulnerability creates an immediate and high risk to any deployment of Jettweb PHP Hazir Haber Sitesi Scripti V1. Organizations currently utilizing this software must prioritize either the implementation of robust WAF protections or the urgent migration to a modern, supported web content management system to eliminate this exposure entirely.