Guardian language-system constructs a SQL query that directly interpolates the user supplied name GET parameter, resulting in SELECT * FROM complex WHERE name=' . $_GET['name'] . '. This flaw permits a classic SQL injection attack. According to the description, an authenticated attacker can perform error‑based SQL injection to extract database contents. The vulnerability is classified as CWE‑89, a classic injection weakness.

The affected product is Guardian language-system, specifically the designer.php script. No explicit affected version list is provided; the flaw exists wherever the unsanitized query remains. Even without a version table, the vulnerability applies to all instances of the vulnerable script.

The CVSS score of 9.3 reflects a severe risk. Exploitation would allow an authenticated attacker to perform error‑based SQL injection, enabling extraction of arbitrary database content and potentially compromising confidentiality and integrity. The EPSS score is not listed, but because the injection requires authentication, the exploit’s success probability depends on whether attackers can authenticate to the system. If authentication barriers are weak or default credentials remain, an attacker could exploit the designer.php endpoint remotely.