Jettweb Php Hazir Ilan Sitesi Scripti V2 has a critical SQL injection flaw that exists in the katgetir.php endpoint. Unauthenticated attackers can inject arbitrary SQL through the 'kat' GET parameter, enabling them to manipulate queries and extract sensitive data. The vulnerability falls under CWE-89 and can lead to loss of confidentiality by exposing database contents.

The flaw affects Jettweb's Ready Advertisement Site Script version 2, as identified by the cpe:2.3:a:jettweb:php_ready_advertisement_site_script:2. The vulnerable endpoint is katgetir.php. No specific sub-versions are listed; the impact applies to all installations of the v2 script that have not applied a patch.

The CVSS score of 8.8 classifies this issue as High severity, while the EPSS score of less than 1% suggests a low predicted exploitation likelihood. The vulnerability is not included in the CISA KEV catalogue. An attacker simply needs network access to the web server hosting the script and can send a crafted GET request to katgetir.php; no authentication is required. Given the ease of exploitation and the potential for data exposure, administrators should treat this as a high-priority risk.