A critical SQL injection vulnerability in KLiK SocialMediaWebsite allows unauthenticated remote attackers to manipulate database queries through the Private Message Handler.

The application is susceptible to SQL injection within the /includes/get_message_ajax.php file, where the c_id parameter is not properly sanitized. This vulnerability is remotely exploitable by unauthenticated users.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant threat to data confidentiality and integrity. Given the CVSS score of 7.3, this high-severity flaw could lead to unauthorized access to private user messages or sensitive database contents, resulting in potential data breaches and loss of user trust.

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the /includes/get_message_ajax.php endpoint via network controls or disable the Private Message functionality if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters targeting the c_id parameter in the identified file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the identified vulnerable endpoint.

Public Exploit Available: Unknown.

The high CVSS score reflects the serious risk posed by this SQL injection vulnerability. Organizations utilizing KLiK SocialMediaWebsite versions 1.0.0 or 1.0.1 must prioritize implementing the suggested compensating controls immediately to prevent unauthorized database access while awaiting official vendor remediation.