Executive brief
Newsbull Haber Script is an open-source software used to manage news websites. A security flaw in its search functionality allows logged-in users to gain unauthorized access to the underlying database. This could lead to the theft of sensitive information, including user credentials and site configuration data, potentially compromising the entire news platform.
Technical details
Multiple SQL injection vulnerabilities exist in Newsbull Haber Script 1.0.0 due to improper neutralization of the 'search' parameter in several administrative endpoints. Specifically, the endpoints /admin/comment/records, /admin/category/records, /admin/news/records, and /admin/menu/childs are affected. An authenticated attacker with low privileges can provide crafted SQL queries via GET requests to perform time-based, blind, or boolean-based injection. This allows for the extraction of sensitive data from the database. The vulnerability is confirmed in version 1.0.0, and there is currently no official patch available as the project appears to be unmaintained.
Affected products
- Gurkan Uzunca Newsbull Haber Script 1.0.0
Timeline
- 2019-01-28: disclosed: Exploit code published on Exploit-DB
- 2026-04-12: advisory: CVE published by VulnCheck/NVD