The guardian language-system contains an SQL injection vulnerability in the job_info.php file at line 16. The id parameter from the GET request is concatenated directly into an SQL query without any sanitization or validation, enabling unauthenticated attackers to execute arbitrary SQL commands. This can lead to disclosure of database version, user, schema, and table data via error-based SQL injection techniques. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this vulnerability to extract sensitive database information including the database version, current database user, schema names, and contents of database tables. This compromises the confidentiality and integrity of the database and potentially the entire system relying on it. The vulnerability does not require authentication or user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries to prevent SQL injection. Restricting access to the vulnerable endpoint and monitoring for suspicious activity may also help reduce risk.