An authenticated SQL injection vulnerability in the Guardian language-system poses a critical threat to the confidentiality of stored file and metadata information.

The application fails to validate the 'id' GET parameter in subtitles.php, allowing an authenticated attacker to inject malicious SQL commands into the backend query. This results in error-based data extraction from the files database.

The exploitation of this vulnerability could lead to the unauthorized retrieval of file metadata and identifiers, potentially facilitating further attacks. The CVSS score of 9.8 highlights the critical urgency of this issue, as it allows for the subversion of database security controls, leading to significant risk of data breach.

Immediate Action: Apply the vendor-supplied security patch for the Guardian language-system immediately.

Proactive Monitoring: Audit server logs for suspicious activity involving 'subtitles.php' and look for evidence of database errors that may indicate injection attempts.

Compensating Controls: Use a WAF to intercept and block requests containing SQL injection patterns directed at the 'id' parameter.

Public Exploit Available: No

The presence of multiple SQL injection points in this product confirms a systemic security weakness. It is imperative that administrators apply the provided updates immediately to mitigate this high-severity risk and prevent unauthorized database access.