Guardian Language-System EUVD-2026-41057

Exploitation requires a valid low-privilege authenticated session on the Guardian language-system application, as indicated by the CVSS PR:L metric and the CVE description's reference to 'an authenticated attacker.' The attacker must be able to issue HTTP GET requests to the media.php endpoint. No special server configuration is required - the vulnerable concatenation executes unconditionally when the id parameter is supplied. The primary limiting factor is the authentication requirement (PR:L); however, the VulnCheck advisory title claims 'unauthenticated' access, directly contradicting both the CVSS vector and the CVE description. This discrepancy must be independently verified before treating authentication as a reliable control. There is no user interaction required (UI:N), no attack complexity barrier (AC:L), and no preconditions (AT:N) beyond a valid session.

The CVSS 4.0 score of 8.7 is driven by network accessibility (AV:N), low complexity (AC:L), no required attack preconditions (AT:N), low-privilege authentication (PR:L), and high impact across all three pillars (VC:H/VI:H/VA:H). EPSS at 0.37% (29th percentile) indicates low observed exploitation probability, but this signal is weak for niche products with small install bases, where the denominator depresses the percentile regardless of exploitability. The publicly available POC and SSVC automatable rating are the more operationally significant signals - once credentials are obtained, exploitation can be scripted. A critical discrepancy exists: the VulnCheck advisory URL labels this 'unauthenticated-sql-injection,' while the CVSS PR:L metric and CVE description both assert that authentication is required; this conflict materially affects the threat model and must be resolved before defenders rely on authentication as a mitigating control. No active exploitation is recorded in CISA KEV at the time of analysis.

An attacker holding any low-privilege account submits a crafted HTTP GET request to media.php with a payload such as id=1' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version())))-- -, causing the database engine to embed sensitive information in a returned error message. By iterating payloads, the attacker enumerates table names, column names, and data rows, exfiltrating credentials, private file metadata, and application content. A public proof-of-concept implementing this technique is available at https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad.