Guardian Language‑System executes the id GET parameter directly inside a SQL query in media.php without any sanitization. This plain concatenation allows an authenticated attacker to craft a malformed id value and trigger an error‑based SQL injection, resulting in the disclosure of database contents. The vulnerability is categorized as CWE‑89 "SQL Injection".

All instances of Guardian Language‑System that contain media.php with an unsanitized id parameter are potentially affected. Since the specific affected versions are not disclosed, this risk is inferred for any deployment that includes the vulnerable script.

The CVSS score of 9.3 indicates a severe risk when the flaw is present. Although the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild, the vulnerability is not listed in the CISA KEV catalog. Exploitation would proceed over HTTP by sending a request to media.php with a crafted id value. The flaw requires authentication to be exploited, limiting the scope to authenticated users.