EUVD-2026-41060
GHSA-94h9-6mg7-9wvx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Guardian application (or exploit unauthenticated if PR:N confirmed)
-
DeliverySend GET request to subtitles.php with malicious id payload
-
ExploitTrigger error-based SQL response leaking metadata
-
ExecutionEnumerate database schemas and tables
-
ImpactExtract user credentials or sensitive records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerability is triggered by supplying a SQL injection payload in the id GET parameter of subtitles.php, which is reachable over the network (AV:N) with no user interaction (UI:N) and low attack complexity (AC:L). Per the CVSS 4.0 vector (PR:L), a low-privilege authenticated session is required; however, the VulnCheck advisory title describes the flaw as 'unauthenticated SQL injection' - this conflict is unresolved and the actual authentication requirement must be verified against the live application before making access-control decisions. No special server-side configuration or non-default deployment mode is required beyond a running Guardian language-system instance with the subtitles.php endpoint network-accessible. Exploitation is bounded by: (1) the potential need for valid credentials (PR:L per CVSS, unconfirmed); (2) the requirement that subtitles.php is reachable from the attacker's network position; and (3) the niche deployment footprint of the product, which limits the population of reachable targets. |
| Impact | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) reflects high confidentiality, integrity, and availability impact with low attack complexity and low privilege requirements - consistent with a near-trivially exploitable SQL injection. SSVC reinforces this: exploitation is classified as poc (confirmed), Automatable as yes (the injection can be scripted at scale across exposed instances), and Technical Impact as total, meaning a successful attacker fully controls the underlying database. Contrasting these high-severity signals, EPSS is only 0.37% (29th percentile), indicating no observed widespread exploitation at time of analysis; this is plausible given the product's niche footprint. A critical unresolved discrepancy exists: the CVE description and CVSS vector (PR:L) describe an authenticated attacker, while the VulnCheck advisory URL explicitly refers to 'unauthenticated SQL injection' - this conflict materially affects real-world risk posture and must be verified with the vendor. If the endpoint is genuinely unauthenticated, the effective attack surface grows dramatically, and the CVSS score and SSVC automatable rating take on heightened urgency. |
| Exploit ScenarioDerived | An attacker with a low-privileged account (per CVSS 4.0 PR:L; authentication requirements are disputed - see confidence notes) sends a crafted GET request such as subtitles.php?id=1' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()))) -- - to trigger a database error message disclosing the MySQL version, then iterates with further payloads to enumerate schemas, tables, and user credential hashes. A public proof-of-concept on GitHub demonstrates this technique, and SSVC confirms the attack is automatable, making bulk credential extraction feasible against any exposed instance without requiring advanced skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Aug 24, 2026
Error-based SQL injection in Guardian language-system's subtitles.php exposes full database contents to low-privileged authenticated attackers via a trivially exploitable unsanitized GET parameter. The CVSS 4.0 vector (PR:L, AC:L, AV:N) and SSVC assessment (Automatable: yes, Technical Impact: total) indicate broad, easily scripted exploitation once credentials are obtained, and a publicly available proof-of-concept on GitHub further lowers the bar. EPSS remains low at 0.37% (29th percentile), suggesting limited in-the-wild activity to date, though a material discrepancy between the CVE description (authenticated) and the VulnCheck advisory title (unauthenticated) must be resolved before accurate risk posture can be established.
Earlier versions of this analysis (2)
SQL injection in Guardian language-system's subtitles.php exposes the full database to attackers via the unsanitized id GET parameter, enabling error-based extraction of all database contents. The vulnerability affects all commits up to e42c395ec4b03fe62973a669c9209a673838b8a4, with a publicly available proof-of-concept exploit on GitHub. SSVC rates technical impact as total and the attack as automatable; however, EPSS at 0.37% (29th percentile) indicates limited observed exploitation to date, and no CISA KEV listing exists - no public exploit identified at time of analysis rises to confirmed active exploitation.
SQL injection in Guardian Language-System's subtitles.php lets attackers extract arbitrary database contents by tampering with the id GET parameter, which is concatenated directly into a SELECT query without sanitization. The flaw is error-based and rated critical (CVSS 4.0 base 9.3, VC:H/VI:H/VA:H), publicly available exploit code exists (VulnCheck advisory plus a public gist PoC), and there is no public exploit identified as being used in active attacks. Note a source conflict: the CVE description labels the attacker 'authenticated,' but the CVSS vector (PR:N) and VulnCheck's advisory title both describe it as unauthenticated.
RemediationAI
No vendor-released patched version has been independently confirmed; the affected version boundary is defined only by git commit e42c395ec4b03fe62973a669c9209a673838b8a4, so operators should update their deployment to a commit beyond that hash and manually verify that subtitles.php no longer concatenates raw GET input into the SQL query. The root cause must be eliminated by replacing the string-concatenation query construction with parameterized queries using PHP's PDO or MySQLi prepared statements, which structurally prevents SQL injection regardless of input content. As an immediate compensating control prior to patching, access to subtitles.php should be restricted at the web server or application layer to only authenticated and explicitly authorized sessions - this is especially urgent if the endpoint is confirmed to be unauthenticated. A WAF rule blocking common SQL injection patterns in the id parameter (e.g., single quotes, UNION, EXTRACTVALUE, error-triggering functions) can reduce exploitation likelihood but is bypassable and must not substitute for a code-level fix. See the public PoC at https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad and the VulnCheck advisory for payload examples useful in testing whether mitigations are effective.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) caused by direct string concatenation of user-supplied GET input into a SQL query in a PHP script. Specifically, subtitles.php at line 16 constructs a SELECT statement as: SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."' - with no parameterization, escaping, or type-casting applied. This pattern enables error-based injection, where deliberately malformed SQL syntax triggers database error messages that disclose internal data, allowing iterative schema and credential enumeration without requiring blind timing techniques. The affected product is identified in CPE as cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*, spanning all versions up to and including git commit e42c395ec4b03fe62973a669c9209a673838b8a4 per EUVD-2026-41060.
Know when Guardian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable PHP endpoint with no interaction needed; PR:L per both CVE description and CVSS 4.0 input; SQL injection enables full database read, write, and availability disruption.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.
Executive ViewAI
Guardian language-system contains a critical SQL injection vulnerability (CVE-2026-34103, CVSS 8.7) that allows low-privileged authenticated users to extract entire database contents via an unsanitized parameter in subtitles.php. Publicly available exploit code exists and the flaw is trivially exploitable; current exploitation is limited (0.4% EPSS), but the public POC creates material risk if any low-privilege account is compromised or misused. No vendor patch is currently available, leaving the database exposed until remediation is completed.
Restrict subtitles.php access at the WAF and firewall level; revoke low-privilege database access where operationally feasible; deploy SQL injection detection and blocking rules; implement comprehensive audit logging for database access from low-privilege accounts; network-segment Guardian systems from critical infrastructure; consider reverse-proxy WAF patching if the vendor remediation timeline extends beyond 30 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
OS command injection in Guardian language-system lets unauthenticated remote attackers run arbitrary shell commands by i
Remote code execution in Guardian language-system allows unauthenticated attackers to run arbitrary OS commands by injec
Unauthenticated SQL injection in Guardian Language System lets remote attackers manipulate the backend database by injec
Error-based SQL injection in Guardian Language-System allows a network-accessible authenticated attacker to extract the
SQL injection in Guardian Language-System's designer.php (line 124) allows attackers to extract, modify, or destroy the
Error-based SQL injection in Guardian Language-System exposes the full database to low-privileged authenticated attacker
Error-based SQL injection in Guardian language-system's text_file.php exposes the full database to extraction via a triv
SQL injection in Guardian language-system's media.php endpoint allows low-privilege authenticated attackers to extract t
Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection. Rated high severity (CVSS 7
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Reflected cross-site scripting in Guardian Language-System's media.php allows authenticated attackers to inject arbitrar
Exploit-DB