The Newsbull Haber Script 1.0.0 contains multiple SQL injection vulnerabilities that enable authenticated attackers to compromise database confidentiality.

This vulnerability consists of improper neutralization of special elements used in SQL commands (CWE-89) within the search parameter. Authenticated attackers can exploit this flaw via multiple administrative endpoints to execute time-based, blind, or boolean-based SQL injection attacks.

Successful exploitation allows an authenticated attacker to extract sensitive data from the underlying database, potentially leading to a full compromise of application information. With a CVSS score of 7.1, this vulnerability represents a significant risk to data integrity and confidentiality for organizations relying on the affected software.

Immediate Action: As no official patch is available for this legacy script, administrators must restrict access to the affected administrative panels to trusted users only and implement strict input validation on the search parameter.

Proactive Monitoring: Security teams should audit web server access logs for anomalous SQL patterns, such as unexpected use of SLEEP functions or boolean logic, within requests directed at the admin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the search parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented on Exploit-DB (EDB-ID: 46266).

Given the availability of public exploit code and the lack of a vendor-supplied patch, the risk posed by this vulnerability is substantial. Organizations should prioritize isolating the affected application from public-facing networks or decommissioning it entirely if it does not meet current security standards.