The vulnerability is a SQL injection flaw in the datagetir.php endpoint of the Jettweb Hazir Haber Sitesi Scripti V3 application. The flaw allows an unauthenticated attacker to inject any SQL code via the 'q' parameter in a GET request, resulting in unintended database queries. This weakness, identified as CWE‑89, can lead to extraction of sensitive database information and, if credentials or privileged data are accessed, can enable further compromise of the underlying system.

Affected product: Jettweb Hazir Haber Sitesi Scripti V3. No specific sub‑versions are listed; the CVE does not specify which version numbers are affected, so any installation presenting the datagetir.php endpoint may be vulnerable.

The CVSS score of 8.8 denotes high severity. The EPSS indicates an exploitation probability of less than one percent, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a remote HTTP GET request to datagetir.php without authentication; based on the description it is inferred that attackers can use time‑based blind SQL injection to retrieve data. The attack vector is web‑based and accessible to any user who can reach the affected endpoint.