CVE-2026-34103: Guardian Language-System Unauthenticated SQL Injection via id Parameter in subtitles.php

Synopsis

Unauthenticated SQL injection affects Guardian language-system, a PHP-based subtitle and file management application. The vulnerability is reachable over the network with no authentication required, as the id GET parameter in subtitles.php is passed directly into a raw SQL query without any sanitization. Successful exploitation gives an attacker full read and write access to the underlying database, and can disrupt service availability. No fix version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable subtitles.php endpoint is exposed over the network, so an attacker must be able to reach the web service via HTTP to send a crafted id parameter.

• AuthenticationNot required

  No credentials are needed; the vulnerable GET parameter is accessible to any unauthenticated request.

• Victim interactionNot required

  The attacker sends a direct HTTP request to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the injection point accepts unsanitized input without any prerequisites such as race conditions or specific memory layout requirements.

Blast Radius

• Reads all data stored in the connected database, including file records, user credentials, and any other persisted application data.
• Modifies or deletes database rows, allowing an attacker to tamper with stored content, corrupt application state, or remove records entirely.
• Crashes or severely degrades the database-backed application by issuing destructive SQL statements, causing a denial of service for all users of the affected instance.
• Depending on database server configuration, may leverage SQL features such as file read/write or out-of-band techniques to pivot further into the host environment.