Guardian language‑system constructs an SQL SELECT query by concatenating the id GET parameter directly without sanitization, creating a classic injection flaw (CWE‑89). When an attacker, who has application credentials, sends a specially crafted id value, the resulting error-based SQL injection can reveal arbitrary rows from the database. Sensitive data such as file metadata, configuration values, or other information accessed by the application can therefore be exposed.

Any installation of Guardian language‑system that exposes the subtitles.php endpoint via the web interface is vulnerable. No specific version numbers are listed, implying the flaw persists as long as the unfiltered code remains in place. Systems that do not restrict access to subtitles.php to authenticated users are at greatest risk.

The CVSS base score of 9.3 classifies this issue as critical, indicating severe potential for data disclosure. The EPSS score of less than 1% shows a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can send a crafted GET request to subtitles.php; while authentication is needed to access the endpoint, the database user must have read privileges. Successful injection would grant the attacker read access to all data the application can query, potentially allowing full compromise of the application’s data layer.