The system contains multiple SQL injection vulnerabilities in the admin panel that allow unauthenticated attackers to manipulate database queries via the GET parameters "tur", "id", and "ozellikdil" on the admin/index.php endpoint. Exploiting these flaws enables an attacker to extract sensitive database information or cause a denial of service. The weakness is classified as CWE-89, indicating input from users is directly included in SQL statements without proper sanitization.

Affected products are provided by Jettweb: the "Rent A Car Scripti" (Php ready rent a car site script) version 4, as indicated by the CPE string cpe:2.3:a:jettweb:php_ready_rent_a_car_site_script:4. The vulnerability resides only in the administration panel of this script.

The CVSS score of 8.8 reflects a high severity, suggesting significant impact if exploited. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, implying no known exploitation to date. Attackers do not need authentication to reach the vulnerable endpoint; the likely attack vector is a remote GET request over the network to /admin/index.php with crafted parameters.