The vulnerability in Jettweb's PHP Hazir Haber Sitesi Script version 1 allows an unauthenticated user to gain administrative access by exploiting improper SQL query validation. The flaw is specifically an SQL injection in the username and password fields of the admingiris.php login form, enabling attackers to bypass authentication and control the administrative interface. This weakness is identified as CWE-89 (SQL Injection).

The affected product is Jettweb: Hazir Haber Sitesi Script v1, as indicated by the CPE string cpe:2.3:a:jettweb:php_stock_news_site_script:1 and the vendor/product listing. Versions beyond v1 are not specifically listed as affected.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is reported as less than 1%, suggesting that exploitation probability is currently low. The vulnerability is not present in CISA's Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is remote access via the publicly reachable admingiris.php login form, where an attacker can submit crafted SQL payloads to bypass authentication. No official workaround or patch is documented, so the risk remains significant for exposed installations.