An unauthenticated remote code execution vulnerability in the Guardian language-system exposes the host server to complete compromise by remote attackers.

The application fails to sanitize the id GET parameter before passing it to a PHP exec() call in subtitles.php. An unauthenticated remote attacker can append shell metacharacters to the parameter to execute arbitrary OS commands.

With a CVSS score of 9.8, this flaw presents an extreme risk to organizational security. Successful exploitation could allow an attacker to gain elevated privileges, access sensitive data, or disable critical security controls, leading to significant operational and reputational damage.

Immediate Action: Update the Guardian language-system to the latest version, which includes patches for the command injection vulnerability in subtitles.php.

Proactive Monitoring: Monitor for unusual system command execution logs or unauthorized file modifications on the server hosting the language-system.

Compensating Controls: Configure a WAF to block requests containing common shell injection characters or patterns targeting the subtitles.php script until the patch is applied.

Public Exploit Available: No

This vulnerability provides an unauthenticated attacker with the ability to execute arbitrary code, necessitating immediate remediation. Organizations should verify their patch management status and ensure that no exposed instances of the affected software remain unpatched.