The guardian language-system is vulnerable to SQL injection via the id GET parameter in translate_text.php (line 15). The parameter is concatenated directly into an SQL query without sanitization: SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."'. This improper neutralization of special elements allows an authenticated attacker to perform error-based SQL injection to extract sensitive database information. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An authenticated attacker can exploit this vulnerability to perform error-based SQL injection, potentially extracting sensitive database contents. This can lead to unauthorized disclosure of data stored in the database. The high CVSS score reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the id parameter.