A flaw in the Private Message Handler of KLiK SocialMediaWebsite allows the manipulation of the c_id argument within the get_message_ajax.php script to inject arbitrary SQL statements. Exploiting this vulnerability can enable an attacker to read, modify, or delete sensitive data stored in the database, undermining data confidentiality and integrity. The impact is confined to database operations and does not directly grant code execution or system control.

KLiK SocialMediaWebsite versions up to and including 1.0.1 are affected. The vulnerability resides in the Private Message Handler component, specifically the /includes/get_message_ajax.php file. Systems running these versions should be considered at risk.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score of less than 1% reflects a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. According to the description, the attack can be performed remotely by sending a crafted request that alters the c_id parameter; no additional authentication or local privilege is required beyond a valid Network access to the web application.