Which versions of KLiK SocialMediaWebsite are affected by CVE-2026-7002?

KLiK SocialMediaWebsite versions 1.0.1 and earlier contain an unauthenticated SQL injection vulnerability in the private message handling component that allows remote attackers to access, modify, or…

How to fix or mitigate CVE-2026-7002?

Within 24 hours: Inventory all systems running KLiK SocialMediaWebsite and verify installed versions against 1.0.1 and earlier; isolate or restrict network access to affected instances if upgrade is not immediately available. Within 7 days: Upgrade to the latest available version of KLiK SocialMediaWebsite beyond 1.0.1; if no patched version exists from the vendor, implement Web Application Firewall (WAF) rules blocking SQL injection patterns in the /includes/get_message_ajax.php endpoint and the c_id parameter. Within 30 days: Conduct database audit to identify unauthorized queries or data access; review access logs for exploitation attempts and implement input validation and parameterized queries at the application layer if vendor patch remains unavailable.

KLiK SocialMediaWebsite CVE-2026-7002

Q: What is the CVSS score of CVE-2026-7002?

CVE-2026-7002 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25677 MEDIUM

SQL Injection (CWE-89)

2026-04-25 VulDB

PHP SQLi

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 25, 2026 - 22:22 NVD

HIGH MEDIUM

CVSS changed

Apr 25, 2026 - 22:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 25, 2026 - 22:00 vuln.today

EUVD ID Assigned

Apr 25, 2026 - 21:45 euvd

EUVD-2026-25677

Analysis Generated

Apr 25, 2026 - 21:45 vuln.today

CVE Published

Apr 25, 2026 - 21:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_message_ajax.php of the component Private Message Handler. Executing a manipulation of the argument c_id can lead to sql injection. It is possible to launch the attack remotely.

AnalysisAI

SQL injection in KLiK SocialMediaWebsite 1.0.1 and earlier allows remote unauthenticated attackers to execute arbitrary SQL commands via the c_id parameter in /includes/get_message_ajax.php. The vulnerability targets the private message handling component and permits unauthorized database access, modification, and potential data exfiltration. CVSS 7.3 reflects network-accessible, low-complexity exploitation requiring no authentication or user interaction, with partial impact to confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, suggesting limited observed exploitation despite the accessible attack surface.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based social media application. The /includes/get_message_ajax.php endpoint, part of the private messaging system, fails to properly sanitize or parameterize the c_id parameter before incorporating it into SQL queries. Based on the CPE (cpe:2.3:a:klik:socialmediawebsite), this affects KLiK's SocialMediaWebsite application version 1.0.1 and potentially earlier versions. The vulnerability class indicates direct concatenation of user-supplied input into database queries without input validation, prepared statements, or adequate escaping. As an AJAX endpoint handling private messages, this component likely queries user conversation data, making it a high-value target for attackers seeking to access sensitive communications, manipulate message histories, or pivot to broader database compromise.

RemediationAI

No vendor-released patch or fixed version has been identified in available intelligence sources. In the absence of official patches, implement these compensating controls: Deploy a web application firewall (WAF) with SQL injection detection rules to filter malicious c_id parameter values before they reach the application - note this adds latency and requires ongoing signature updates. Restrict network access to /includes/get_message_ajax.php to authenticated sessions only through web server configuration (Apache mod_rewrite or nginx location blocks) - this reduces attack surface but may break legitimate AJAX functionality if the application expects unauthenticated access. Implement database user permission restrictions limiting the web application's database account to minimum required privileges, preventing SELECT queries from accessing sensitive tables and blocking DELETE/UPDATE/DROP operations entirely - this contains damage but does not prevent data exfiltration from accessible tables. Monitor application logs for suspicious c_id parameter patterns including SQL keywords, comment sequences, or union-based injection attempts. Check vendor channels and https://vuldb.com/vuln/359561 for patch announcements. If private messaging functionality is non-critical, disable the vulnerable endpoint entirely until patches are available.