EUVD-2026-41060
GHSA-94h9-6mg7-9wvx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable PHP endpoint with no interaction needed; PR:L per both CVE description and CVSS 4.0 input; SQL injection enables full database read, write, and availability disruption.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
6DescriptionCVE.org
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.
AnalysisAI
Error-based SQL injection in Guardian language-system's subtitles.php exposes full database contents to low-privileged authenticated attackers via a trivially exploitable unsanitized GET parameter. The CVSS 4.0 vector (PR:L, AC:L, AV:N) and SSVC assessment (Automatable: yes, Technical Impact: total) indicate broad, easily scripted exploitation once credentials are obtained, and a publicly available proof-of-concept on GitHub further lowers the bar. EPSS remains low at 0.37% (29th percentile), suggesting limited in-the-wild activity to date, though a material discrepancy between the CVE description (authenticated) and the VulnCheck advisory title (unauthenticated) must be resolved before accurate risk posture can be established.
Technical ContextAI
The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) caused by direct string concatenation of user-supplied GET input into a SQL query in a PHP script. Specifically, subtitles.php at line 16 constructs a SELECT statement as: SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."' - with no parameterization, escaping, or type-casting applied. This pattern enables error-based injection, where deliberately malformed SQL syntax triggers database error messages that disclose internal data, allowing iterative schema and credential enumeration without requiring blind timing techniques. The affected product is identified in CPE as cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*, spanning all versions up to and including git commit e42c395ec4b03fe62973a669c9209a673838b8a4 per EUVD-2026-41060.
RemediationAI
No vendor-released patched version has been independently confirmed; the affected version boundary is defined only by git commit e42c395ec4b03fe62973a669c9209a673838b8a4, so operators should update their deployment to a commit beyond that hash and manually verify that subtitles.php no longer concatenates raw GET input into the SQL query. The root cause must be eliminated by replacing the string-concatenation query construction with parameterized queries using PHP's PDO or MySQLi prepared statements, which structurally prevents SQL injection regardless of input content. As an immediate compensating control prior to patching, access to subtitles.php should be restricted at the web server or application layer to only authenticated and explicitly authorized sessions - this is especially urgent if the endpoint is confirmed to be unauthenticated. A WAF rule blocking common SQL injection patterns in the id parameter (e.g., single quotes, UNION, EXTRACTVALUE, error-triggering functions) can reduce exploitation likelihood but is bypassable and must not substitute for a code-level fix. See the public PoC at https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad and the VulnCheck advisory for payload examples useful in testing whether mitigations are effective.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today