This vulnerability is an authenticated SQL injection flaw that resides in the search parameter of Newsbull Haber Script 1.0.0. Once an attacker has a legitimate user session, they can inject malicious SQL into endpoint searches such as /admin/comment/records, /admin/category/records, /admin/news/records, and /admin/menu/childs. The injected payloads can be delivered using time‑based, blind, or boolean‑based techniques to read sensitive data from the database. The primary consequence is the uncontrolled disclosure of stored information such as user credentials, configuration data, or any other data the database contains. No direct privilege escalation or arbitrary code execution is implied.

The affected product is Newsbull Haber Script version 1.0.0, as disclosed by the CNA. No other releases or versions are documented as vulnerable, so systems running this exact version are at risk. Protection of the system is contingent upon mitigating or patching this specific edition.

The CVSS score of 7.1 marks this issue as high severity. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the web application; once authenticated, an attacker can send crafted search queries that manipulate SQL statements and retrieve confidential data. The weakness does not enable remote code execution or system compromise beyond data exfiltration, but the high potential impact warrants prompt remediation.