Executive brief
KLiK SocialMediaWebsite 1.0 contains a security flaw in its file handling system. This allows an attacker to upload unauthorized files to the server without any authentication. An exploit could lead to a complete takeover of the website, data theft, or the hosting of malicious content.
Technical details
An unrestricted file upload vulnerability exists in KLiK SocialMediaWebsite 1.0 within the File Handler component. The flaw is located in the 'uniqid' function of the 'upload.inc.php' file, which fails to properly validate or restrict the types of files being uploaded. A remote, unauthenticated attacker can exploit this by sending a specially crafted request to upload arbitrary files, such as PHP scripts, to the web server. Successful exploitation allows for remote code execution (RCE) and full system compromise. The exploit has been publicly disclosed.
Affected products
- KLiK SocialMediaWebsite 1.0
Timeline
- 2026-05-25: advisory: Initial disclosure by VulDB and NVD
- 2026-05-25: disclosed: Exploit code has been publicly disclosed