The vulnerability originates from an unsanitized SQL query that directly concatenates the user input from the name parameter into a SELECT statement performed by designer.php. This flaw permits a classic SQL injection attack (CWE‑89) that can reveal sensitive information from the database through error‑based techniques. The description specifies that an authenticated attacker can perform this injection to extract database contents, and no evidence suggests that unauthenticated users can exploit the flaw.

The affected product is Guardian language-system. The specific versions that contain the unsanitized query are not enumerated, so the flaw applies to any instance of the software where the vulnerable designer.php endpoint remains unchanged.

The CVSS score of 9.3 reflects the severe potential for data exposure and integrity compromise. The EPSS score of less than 1% indicates a low likelihood of exploitation. Although the vulnerability is currently not listed in the CISA KEV catalog, it remains serious, especially if an attacker gains authenticated access. The attack vector is a web request targeting the designer.php endpoint, and the vulnerability can be exploited only by authenticated users who can supply a crafted name parameter.