Jettweb PHP Hazir Haber Sitesi Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in Jettweb PHP Hazir Haber Sitesi Scripti V3. This vulnerability resides in the login.php administration panel, allowing unauthenticated attackers to gain administrative access by exploiting SQL injection. Attackers can bypass authentication by injecting equals signs and 'or' operators into the username and password fields, thereby accessing the administration panel without valid credentials.

Impact

Exploitation of this vulnerability allows for unauthorized administrative access to the application.

Reproduction

To reproduce this vulnerability, navigate to the login.php administration panel. Enter '=' followed by 'or' in both the username and password fields. Submit the login form to gain access to the administration panel without valid credentials.