Guardian Language-System CVE-2026-34104

The CVE description specifies that an authenticated attacker is required, consistent with the CVSS 4.0 PR:L metric indicating low-level privileges are needed. The vulnerable endpoint is designer.php, which must be publicly reachable over HTTP/HTTPS; if this file is not web-accessible or is restricted by server configuration, exploitation is blocked. The application must return verbose SQL error messages to the HTTP response for error-based extraction to succeed - suppressing database errors (e.g., via PHP display_errors=Off and custom error handling) would prevent data exfiltration via this technique, though blind injection variants may still be possible. CRITICAL DISCREPANCY: The VulnCheck advisory title describes the flaw as 'unauthenticated' while the CVE description states 'authenticated' and PR:L confirms some credentials are required - the actual authentication prerequisite must be independently verified with the vendor before finalizing defensive posture, as it materially changes the attack surface.

The CVSS 4.0 base score of 8.7 with a vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H accurately reflects a severe, remotely exploitable vulnerability with minimal attack complexity. However, EPSS sits at only 0.37% (29th percentile), suggesting low observed exploitation activity in the wild at time of analysis despite the public POC - this low EPSS may reflect the product's limited deployment footprint rather than genuine low attacker interest. The SSVC classification of Automatable:Yes and Technical Impact:Total elevates urgency significantly: a scripted tool could enumerate and extract the entire database without manual effort, making this attractive for opportunistic bulk scanning even against a niche target. The POC hosted on GitHub Gist lowers the bar further by providing ready-made exploit code. The authentication discrepancy between the CVE description (authenticated) and the VulnCheck title (unauthenticated) is the single most critical unresolved data point - if exploitation truly requires no credentials, the effective risk is materially higher than PR:L implies, and even a small operator running this software should treat immediate remediation as urgent regardless of their scale.

An attacker with low-privilege credentials (or, if the VulnCheck title is correct, no credentials at all) sends a crafted HTTP GET request to designer.php with a malicious name parameter containing an error-based SQL injection payload such as ' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT user())))-- -. The application returns a database error message containing the extracted value, allowing the attacker to iteratively enumerate table names, column names, and data rows. A ready-made proof-of-concept for this technique is publicly available at the GitHub Gist referenced in CVE sources, significantly reducing attacker skill requirements.