Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection flaw that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter in haberarsiv.php. The vulnerability is a classic "Unrestricted Input" weakness (CWE-89) and can lead to extraction of sensitive data or modification of database contents, potentially compromising confidentiality, integrity, and availability of the site’s information. According to the vendor description, the flaw is caused by improper validation of the cid input, enabling UNION‑based injection to read or alter data.

The affected system is the Jettweb Hazir Haber Sitesi Script v1. The product is identified by the CPE string cpe:2.3:a:jettweb:php_stock_news_site_script:1.*. No additional version information is supplied beyond the major revision 1.

The CVSS score of 8.8 indicates a high severity with a high impact. The EPSS score of <1% suggests that the likelihood of exploitation in the near term is low, and the vulnerability is not listed in the CISA KEV catalog, implying it is not known to be actively exploited in widespread attacks. Attackers would perform the exploit by sending HTTP requests directly to haberarsiv.php with a malicious cid value; no authentication is required.