Description
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.
Published: 2026-07-01
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Guardian Language‑System executes the id GET parameter directly inside a SQL query in media.php without any sanitization. This plain error‑based SQL injection allows an authenticated attacker to extract database contents.

Affected Systems

All instances of Guardian Language‑System that contain media.php with an unsanitized id parameter are potentially affected. Since the specific affected versions are not disclosed, this risk is inferred for any deployment that includes the vulnerable script.

Risk and Exploitability

The CVSS score of 9.3 indicates a severe risk when the flaw is present. Although the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild, the vulnerability is not listed in the CISA KEV catalog. Exploitation would proceed over HTTP by sending a request to media.php with a crafted id value. The flaw requires authentication to be exploited, limiting the scope to authenticated users.

Generated by OpenCVE AI on August 1, 2026 at 23:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑issued version where media.php sanitizes the id parameter or uses prepared statements.
  • Implement parameterized queries or stored procedures for all database values, especially id parameters.
  • Restrict access to media.php to authenticated users only and enforce least‑privilege access controls. If a patch is not yet available, temporarily block or limit the endpoint via web‑server rules or a firewall to reduce exposure.

Generated by OpenCVE AI on August 1, 2026 at 23:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Guardian
Guardian language-system
Vendors & Products Guardian
Guardian language-system

Wed, 01 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Description Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.
Title Guardian Language-System Unauthenticated SQL Injection via id Parameter in media.php
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Guardian Language-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-14T18:40:15.459Z

Reserved: 2026-03-25T18:43:09.826Z

Link: CVE-2026-34100

cve-icon Vulnrichment

Updated: 2026-07-01T16:48:37.996Z

cve-icon NVD

Status : Deferred

Published: 2026-07-01T17:16:32.940

Modified: 2026-07-14T19:16:59.477

Link: CVE-2026-34100

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T23:15:03Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')