Jettweb PHP Hazir Haber Sitesi SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Jettweb PHP Hazir Haber Sitesi Scripti Version 1. This vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'gallery_id' parameter. Exploitation involves sending GET requests to 'gallery.php' with malicious 'gallery_id' values, using UNION-based SQL injection to extract sensitive database information.

Impact

Exploitation of this vulnerability allows for unauthorized database access and manipulation, potentially leading to the exposure of sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to 'gallery.php' with a crafted 'gallery_id' parameter that includes SQL injection payloads. The injection can be verified by extracting database information through the UNION-based SQL injection technique.