This vulnerability affects KLiK SocialMediaWebsite versions 1.0.0 and 1.0.1 in the Private Message Handler component. An attacker can remotely manipulate the c_id parameter in the /includes/get_message_ajax.php script to perform SQL injection attacks. The vulnerability is classified under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the c_id parameter. This could lead to unauthorized data access or modification. However, the impact is rated as low to medium based on the CVSS vector, indicating limited confidentiality, integrity, and availability impact. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently provided, users should monitor for vendor updates. Until a fix is available, consider restricting access to the affected endpoint or implementing web application firewall rules to detect and block suspicious SQL injection attempts targeting the c_id parameter.