The vulnerability exists in Jettweb PHP Hazir Haber Sitesi Scripti V3 due to improper handling of login credentials in login.php. By submitting crafted SQL syntax containing equals signs and 'or' operators as both username and password, an attacker can bypass authentication and gain unrestricted administrative control over the site. This results in full control of the web application, allowing an attacker to alter content, modify configurations, or exfiltrate sensitive data. The weakness is a classical SQL Injection reflected in an authentication context (CWE-89).

Affected vendor: Jettweb; product: Hazir Haber Sitesi Scripti V3 (also listed as php_stock_news_site_script). No specific affected version information is provided by the CNA; however the CPE string cpe:2.3:a:jettweb:php_stock_news_site_script:3:*:*:*:*:*:*:* indicates the vulnerability exists in version 3 of the script.

The CVSS base score is 8.7, indicating high severity. EPSS is less than 1%, suggesting low likelihood of recent exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by sending an unauthenticated HTTP request to the login.php endpoint with specially crafted parameters, thereby bypassing authentication. Because the vulnerability is not yet widely exploited, monitoring for suspicious login attempts and enforcing network-level restrictions is also advisable.