Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FRO…

CVE-2026-34103 affects the Guardian language-system web application, where the 'id' GET parameter is passed unsanitized into a SQL query in subtitles.php at line 16. The vulnerable query directly concatenates user input: SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."'. An authenticated attacker can exploit this flaw via error-based SQL injection to extract database contents. The vulnerability is classified as authenticated SQL injection, requiring a valid session to exploit. The affected file and query structure are publicly disclosed, lowering the barrier for exploitation. References include a public GitHub Gist with proof-of-concept details and a VulnCheck advisory. The issue highlights poor input validation and lack of prepared statements in the application's database interaction layer.