An unauthenticated command injection vulnerability in the Guardian language-system allows remote attackers to execute arbitrary OS commands with server-level privileges.

The application fails to sanitize the 'id' GET parameter before passing it to a PHP exec() function in text.php. This allows an unauthenticated attacker to inject shell metacharacters and execute arbitrary operating system commands.

A CVSS score of 9.8 reflects the severe impact of this vulnerability, which facilitates full remote code execution. Successful exploitation results in complete system compromise, enabling attackers to install backdoors, exfiltrate sensitive data, or pivot into the internal network, leading to significant reputational and operational damage.

Immediate Action: Apply the latest security update provided by Guardian to address the command injection vulnerability in text.php.

Proactive Monitoring: Review web server access logs for requests containing shell metacharacters (e.g., ;, |, &, `) in the 'id' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing common shell injection payloads targeting the text.php file.

Public Exploit Available: No

This vulnerability is trivial to exploit and carries extreme risk to the host server. Security teams should treat this as a high-priority remediation item and verify that all instances of the Guardian language-system are patched or isolated from public access until a fix is deployed.