Guardian language‑system builds an SQL statement by concatenating the value of the HTTP GET parameter "id" directly into the query SELECT * FROM jobs where input1 = '\".$_GET["id"].\"'. This missing input validation creates a classic SQL injection flaw (CWE‑89). An attacker who can provide a crafted value for the id parameter can cause the database to execute arbitrary SQL commands, primarily enabling extraction of confidential tables through error‑based responses and potentially more destructive queries if the database user has additional privileges.

The vulnerability exists in the job_info_get.php component of the Guardian language‑system. Because no specific version numbers are disclosed, any installation that has not been patched to avoid the direct string concatenation is potentially exposed. The flaw resides entirely in the code that processes the id parameter, so the risk applies to every instance of this component that remains unmodified.

With a CVSS score of 9.3 the flaw is critically severe. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an HTTP GET request to job_info_get.php containing a malicious id value; an authenticated attacker can issue this request, cause the database to execute the injected code, and extract or manipulate data.