CVE-2026-34102: Guardian Language-System Unauthenticated SQL Injection via id Parameter in job_info_get.php

Synopsis

An unauthenticated SQL injection vulnerability exists in Guardian language-system, specifically in the job_info_get.php script where the id GET parameter is passed directly into a SQL query without sanitization. The vulnerability is reachable over the network and requires no authentication or user interaction, derived from the CVSS v4.0 vector (AV:N, PR:N, UI:N). Successful exploitation gives an attacker full read and write access to the underlying database, including all stored records, and can disrupt service availability. HarborGuard tracks this advisory for patch availability, as no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint job_info_get.php is exposed over the network, so an attacker must be able to reach the service via HTTP/HTTPS from a remote network position.

• AuthenticationNot required

  The CVSS v4.0 vector specifies PR:N, meaning no account or credential of any privilege level is needed to exploit the injection; note the description's reference to an authenticated attacker appears inconsistent with this vector.

• Victim interactionNot required

  The CVSS v4.0 vector specifies UI:N, so the attacker can trigger the injection by sending a crafted HTTP request directly, with no action required from any user of the application.

• Attack complexityDetail

  The CVSS v4.0 vector specifies AC:L, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access to the endpoint.

Blast Radius

• An attacker can read the full contents of the jobs database table and any other table reachable via the injection, exposing all stored application records.
• An attacker can write or modify database rows, allowing manipulation of job listings, user data, or any other persisted content.
• The attack can disrupt availability of the database layer, causing service outages for the affected application.
• Because no scope change is indicated (SC:N), impact is confined to the vulnerable system itself, but full compromise of that system's data store is achievable.