Jettweb PHP Hazir Rent A Car Sitesi Script V2 contains a SQL injection vulnerability that permits unauthenticated attackers to inject SQL code into the arac_kategori_id parameter, thereby manipulating database queries. The primary impact is the potential extraction of sensitive database information, compromising the confidentiality of data stored by the application. This weakness aligns with CWE-89 (SQL Injection).

The affected system is the Jettweb PHP Hazir Rent A Car Sitesi Script version 2, as identified by the CPE cpe:2.3:a:jettweb:php_ready_rent_a_car_site_script:2:*:*:*:*:*:*.* Only the version 2 release is known to be vulnerable; sub‑versions or newer releases are not documented in the data.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is less than 1%, suggesting a low current exploitation probability. This vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this through unauthenticated HTTP POST requests to the vulnerable endpoint, as the description states that malicious payloads can be injected via the arac_kategori_id parameter. The exploitation requires no pre-authentication and can be performed by any remote actor capable of sending HTTP requests to the application.