KLiK SocialMediaWebsite CVE-2026-7002

Exploitation requires the /includes/get_message_ajax.php endpoint to be network-accessible to the attacker, which is typical for AJAX endpoints in web applications. The CVSS vector PR:N confirms no authentication is required - the vulnerable endpoint processes requests from unauthenticated users. Successful exploitation depends on the specific SQL query structure and database permissions: attackers can inject arbitrary SQL, but actual impact (data extraction scope, write capabilities, command execution via database features) varies based on backend database type (MySQL, PostgreSQL, etc.), application database user privileges, and query construction. The 'Private Message Handler' component designation suggests the endpoint queries conversation or messaging tables, which may contain sensitive user communications. No special client-side conditions, user interaction, or non-default configurations are required based on UI:N in the CVSS vector.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable without authentication, presenting a significant attack surface for internet-facing deployments. However, real-world risk depends heavily on deployment context. The CVSS 7.3 score reflects partial CIA impact (C:L/I:L/A:L), suggesting exploitation may be constrained by database permissions, application logic, or query structure rather than complete database takeover. No EPSS score provided, but absence from CISA KEV and lack of public POC in references suggest exploitation has not become widespread or automated. The VulDB submission indicates researcher disclosure rather than in-the-wild observation. Primary risk is to organizations running internet-accessible instances of KLiK SocialMediaWebsite 1.0.1 or earlier, particularly those storing sensitive user data in private messages. Applications behind authentication layers, WAFs with SQL injection signatures, or those with read-only database permissions face reduced practical risk despite the high CVSS rating. Missing vendor advisory and patch information creates uncertainty about remediation timeline.

An unauthenticated attacker identifies KLiK SocialMediaWebsite from fingerprinting and crafts a malicious HTTP request to /includes/get_message_ajax.php with a c_id parameter containing SQL injection payload such as '1 UNION SELECT username,password,email FROM users--'. The vulnerable PHP code concatenates this input directly into a SQL query without sanitization, executing the attacker's injected commands. The attacker extracts private message contents, user credentials, or other database contents depending on application database schema and permissions, potentially pivoting to account takeover or broader system compromise.