CVE-2026-34101: Guardian Language-System Unauthenticated SQL Injection via id Parameter in text_file.php

Synopsis

An unauthenticated SQL injection vulnerability affects Guardian language-system, a PHP-based file management component. The application passes the id GET parameter directly into a raw SQL query in text_file.php without any sanitization or parameterization, allowing a remote attacker to manipulate the query structure. Successful exploitation gives an attacker full read and write access to the underlying database, including all stored file records, user data, and any other persisted content. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint in text_file.php is exposed over the network, so an attacker must be able to reach the web service via HTTP or HTTPS.

• AuthenticationNot required

  No credentials are required; the id parameter is accessible to unauthenticated requests, meaning any anonymous caller can submit a crafted payload.

• Victim interactionNot required

  The attacker sends a crafted GET request directly to the server; no user action or social engineering is needed.

• Attack complexityDetail

  Exploitation is straightforward and condition-free, with no race conditions or special environmental state required to land a working injection payload.

Blast Radius

• An attacker reads the full contents of the files table, including filenames, extensions, types, durations, owner identifiers, and private-flag values.
• Error-based SQL injection techniques allow enumeration of other database tables, extracting credentials, session tokens, or any other persisted application data.
• An attacker with write capability through stacked queries or writable SQL features can modify or delete database rows, corrupting stored records.
• Full database compromise disrupts service availability by dropping tables or flooding the backend with expensive injected queries, crashing dependent application features.