The guardian language-system is vulnerable to SQL injection due to improper neutralization of special elements in the id GET parameter passed to subtitles.php. The SQL query concatenates the id parameter directly without sanitization: SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."'. This allows an authenticated attacker to perform error-based SQL injection attacks to extract sensitive database information. No vendor advisory or patch information is available, and the vulnerability is not related to a cloud service.

An authenticated attacker can exploit this vulnerability to perform error-based SQL injection, potentially extracting sensitive database contents. The CVSS 4.0 score of 9.3 reflects a critical impact with high confidentiality, integrity, and availability impacts. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and validate or sanitize all user inputs, especially the id GET parameter, to prevent SQL injection.