An unauthenticated SQL injection vulnerability in the Jettweb PHP Hazir Haber Sitesi Scripti administrative login portal allows attackers to gain unauthorized administrative access.

This vulnerability is caused by improper neutralization of special elements used in SQL commands (CWE-89) within the admingiris.php login form. An unauthenticated attacker can supply crafted SQL injection payloads in the username and password fields to bypass authentication entirely and gain control of the administrative interface.

Successful exploitation grants an attacker full administrative access to the web application. This could lead to total compromise of the site, including unauthorized data exfiltration, modification of news content, and potential further exploitation of the underlying server infrastructure. Given the CVSS score of 8.2, this vulnerability represents a high risk to business operations and data integrity.

Immediate Action: As no official patch is available for this legacy script, administrators should immediately restrict access to the administrative directory (/yonetim/) via IP whitelisting or additional password-protected authentication layers.

Proactive Monitoring: Review web server access logs for suspicious POST requests directed at admingiris.php, particularly those containing SQL syntax characters like quotes, semicolons, or comment sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting login parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the Exploit-DB entry 46597.

Due to the severity of this authentication bypass and the availability of public exploit material, immediate defensive action is required. Administrators should prioritize migrating away from this unsupported software, as the lack of an official patch leaves the installation permanently vulnerable to credential-based attacks. If migration is not immediately possible, strict network-level access controls are required to mitigate the risk of unauthorized administrative entry.