CVE-2026-34105: Guardian Language-System SQLi Vulnerability

CVE-2026-34105 Overview

CVE-2026-34105 is a SQL injection vulnerability in the Guardian language-system web application. The flaw resides in translate_text.php at line 15, where the id GET parameter is concatenated directly into a SQL query without sanitization. The affected query is SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."'. An attacker can perform error-based SQL injection to extract arbitrary data from the backend database. The issue is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Attackers can extract full database contents including credentials and sensitive file metadata through error-based SQL injection over the network without user interaction.

Affected Products

Guardian language-system (translate_text.php)

Discovery Timeline

2026-07-01 - CVE-2026-34105 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-34105

Vulnerability Analysis

The vulnerability is a classic first-order SQL injection in the Guardian language-system component. The translate_text.php script reads the id value from the HTTP GET request and inserts it into a SQL statement via PHP string concatenation. No prepared statements, parameter binding, or input filtering are applied before the query reaches the database engine.

Because the query returns file metadata from the files table, attackers can leverage error-based techniques to exfiltrate data across all accessible schemas. Injected payloads that trigger database errors, such as those using EXTRACTVALUE or UPDATEXML on MySQL backends, disclose query results within the resulting error message.

Successful exploitation compromises confidentiality, integrity, and availability of the backend database. Depending on database privileges, an attacker may pivot to writing files or executing commands on the database host.

Root Cause

The root cause is direct interpolation of the untrusted $_GET['id'] superglobal into a SQL string literal. The application relies on single-quote wrapping alone, which does not prevent injection when special characters such as ' are supplied. No parameterized query API is used.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends a crafted GET request to translate_text.php with a malicious id parameter value. The injected SQL fragment executes in the database context, and error output is returned in the HTTP response, enabling extraction of table contents column by column.

The vulnerability mechanism is described in the VulnCheck Security Advisory and demonstrated in a GitHub Gist Exploit Example. No verified sanitized exploit code is reproduced here.

Detection Methods for CVE-2026-34105

Indicators of Compromise

HTTP GET requests to translate_text.php containing SQL metacharacters in the id parameter, such as ', --, UNION, SELECT, EXTRACTVALUE, or UPDATEXML.
Web server access logs showing repeated requests to translate_text.php?id= with abnormally long or URL-encoded payloads.
Database error messages returned in HTTP responses referencing the files table.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting the id query string parameter on translate_text.php.
Correlate HTTP 500 responses from translate_text.php with corresponding database error logs to identify probing attempts.
Alert on outbound data volumes from the database host that exceed the historical baseline for the language-system application.

Monitoring Recommendations

Enable verbose query logging on the database backend and route logs to a centralized analytics platform for retention and search.
Monitor the files table for anomalous read patterns, including sequential scans issued from the web application user.
Track authentication logs on the database for unexpected privilege changes originating from the application service account.

How to Mitigate CVE-2026-34105

Immediate Actions Required

Restrict network access to translate_text.php until a patched build is deployed, using firewall rules or reverse-proxy allowlists.
Rotate database credentials used by the Guardian language-system application in case they were exposed through prior injection attempts.
Review database audit logs for evidence of unauthorized SELECT activity against the files table and adjacent schemas.

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry for CVE-2026-34105. Refer to the VulnCheck Security Advisory for the latest remediation status. Replace the vulnerable concatenation with a prepared statement using PDO or mysqli parameter binding.

Workarounds

Enforce server-side validation that constrains the id parameter to numeric values only, rejecting any request containing non-digit characters.
Deploy a WAF signature that blocks SQL keywords and metacharacters in the id parameter on the vulnerable endpoint.
Reduce database account privileges granted to the application to the minimum required for read access, removing FILE, INTO OUTFILE, and administrative rights.

bash

# Example WAF rule (ModSecurity) blocking SQLi payloads on translate_text.php
SecRule REQUEST_URI "@contains /translate_text.php" \
  "chain,phase:2,deny,status:403,id:1026034105,msg:'CVE-2026-34105 SQLi attempt'"
  SecRule ARGS:id "@rx (?i)(union|select|--|'|extractvalue|updatexml|sleep\()" "t:none,t:urlDecodeUni"