CVE-2026-34105: Guardian Language-System Unauthenticated SQL Injection via id Parameter in translate_text.php

Synopsis

An unauthenticated SQL injection vulnerability exists in Guardian language-system, a PHP-based file translation component. The id GET parameter in translate_text.php is passed directly into a SQL query without sanitization, allowing any network-accessible attacker with no credentials to inject arbitrary SQL. Successful exploitation gives the attacker full read and write access to the database and can crash the affected service. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable translate_text.php endpoint must be reachable over the network; an attacker sends a crafted HTTP request from any internet or internal network position.

• AuthenticationNot required

  No account or session token is needed; the injected parameter is processed before any authentication check. (Note: the description says 'authenticated attacker' but the CVSS vector specifies PR:N, meaning no privileges are required according to the authoritative score.)

• Victim interactionNot required

  The attacker sends the malicious request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the parameter is passed unsanitized into the query with no mitigating controls or race conditions required.

Blast Radius

• Reads all database contents accessible to the application database user, including stored records, credentials, and session data.
• Modifies or deletes persisted database rows, enabling data tampering or destruction.
• Crashes the affected database service or application process through malformed query injection, causing a denial of service.
• Depending on database-user privileges, may write files to the server filesystem via SQL outfile techniques, expanding attacker control beyond the database.