A flaw in the uniqid function used by the file upload component allows an attacker to upload arbitrary files without restriction. This weakness, identified as CWE‑434, permits the remote submission of potentially malicious files and, combined with the lack of proper access controls (CWE‑284), could enable malicious code placement or upload of harmful content. The vulnerability is exploitable from a remote location and has been publicly disclosed.

The issue affects KLiK SocialMediaWebsite version 1.0 and earlier builds incorporating the file upload.inc.php handler from the File Handler component. Users who have not applied updates or removed the upload capability are potentially vulnerable.

With a CVSS score of 6.9, the vulnerability presents a medium severity risk. No EPSS score is available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting it may not be widely exploited yet. However, the attack vector is remote and does not require authentication, indicating that any exposed upload endpoint could be abused. The combination of unrestricted file upload and inadequate access control elevates the risk of successful exploitation should an attacker discover the endpoint.