Executive brief
Destekz, a support or management platform developed by Raera, contains a critical security flaw that allows unauthorized individuals to manipulate its database. An attacker could use this vulnerability to steal sensitive customer data, modify records, or disrupt the service entirely. Because the vendor has stated the product is no longer supported, no official security updates will be released, leaving users permanently at risk.
Technical details
A SQL injection vulnerability exists in Raera Destekz through version 02062026 due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw is exploitable over the network without any prior authentication or user interaction. A successful exploit allows a remote attacker to execute arbitrary SQL queries against the backend database, potentially leading to full data exfiltration, unauthorized modification of records, or administrative bypass. The vendor has confirmed the product is unsupported, meaning no patch is available.
Affected products
- Raera - Ankara Web Design and Digital Advertising Agency Destekz through 02062026
Timeline
- 2026-07-03: advisory: NVD and TR-CERT published the advisory
- 2026-07-03: disclosed: Vendor confirmed product is no longer supported