The vulnerability exists in Jettweb PHP Hazir Haber Sitesi Scripti V1 and allows attackers to inject arbitrary SQL through the poll parameter in arama.php. By sending crafted POST requests, an attacker can read sensitive data from the database, modify records, or delete information, thereby compromising confidentiality and integrity. The weakness is classified as CWE-89 (SQL Injection).

Affected systems include the Jettweb Hazir Haber Sitesi Scripti version 1, as identified by the CPE cpe:2.3:a:jettweb:php_stock_news_site_script:1:*:*:*:*:*:*:* and the vendor’s product listing.

The CVSS score of 8.8 indicates a high severity. The EPSS score is reported as less than 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only a POST request to arama.php with an injected payload, and no authentication is required, making the attack vector remote and publicly reachable. This aligns with the vendor description stating that unauthenticated attackers can manipulate database queries.