An authenticated SQL injection vulnerability in the Guardian language-system allows an attacker to compromise sensitive database information through the media.php component.

The application fails to sanitize the 'id' GET parameter in 'media.php', leading to error-based SQL injection. This requires the attacker to have an authenticated session to exploit the vulnerability effectively.

With a CVSS score of 9.8, the impact is severe as it allows lateral movement or privilege escalation for an attacker who has already achieved low-level access. Unauthorized access to the database could result in the compromise of sensitive organizational information, undermining the confidentiality and integrity of the application.

Immediate Action: Upgrade to the latest version of the Guardian language-system as recommended by the vendor.

Proactive Monitoring: Monitor application logs for suspicious activity following authentication, specifically looking for unusual patterns in database queries originating from authenticated user sessions.

Compensating Controls: Ensure strict input validation is applied at the application level and utilize WAF rules to filter out suspicious SQL syntax in requests.

Public Exploit Available: Unknown

Although this vulnerability requires an authenticated session, the potential for data exfiltration remains critical. Administrators should prioritize updating the system and enforcing the principle of least privilege to minimize the potential impact should a user account be compromised.