CVE-2026-34099: Guardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.php

Synopsis

This is an unauthenticated SQL injection vulnerability in Guardian language-system, a PHP-based job listing application. The job_info.php script passes the id GET parameter directly into a raw SQL query with no sanitization and no login required, meaning any attacker with network access to the server can exploit it immediately. Successful exploitation gives the attacker full read and write access to the underlying database, including the ability to dump all stored records. No fix version has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the job_info.php endpoint over the network; any internet-exposed or internally routable deployment is within scope.

• AuthenticationNot required

  No account, session token, or credential of any kind is needed to reach the vulnerable parameter.

• Victim interactionNot required

  The attacker sends a crafted HTTP GET request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the injection point is consistently reachable and requires no special timing, memory layout knowledge, or environmental preconditions.

Blast Radius

• Reads all rows in every database table, including stored job listings, user records, credentials, and any other data the application database holds.
• Reads the current database user identity, schema names, and version information, giving the attacker a precise map of the database for further exploitation.
• Modifies or deletes persisted database rows, enabling tampering with job records or destruction of stored data.
• Crashes or degrades the database service through malformed queries, causing availability loss for the application.