Baptism Information Management System CVE-2026-108927

Exploitation requires an authenticated session with at least low-privilege access to the Baptism Information Management System web application (CVSS PR:L), after which the attacker sends a malicious value in the b_id parameter to the pbaptism.php endpoint. No special non-default configuration or user interaction is required (UI:N), and the request is remotely deliverable over the network (AV:N). The primary limiting factors are the authentication requirement and the extremely small deployment base of this niche PHP application; there is no indication the vulnerable endpoint is reachable pre-authentication.

This is a low-to-moderate real-world risk despite the publicly available exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but PR:L means an attacker must already hold at least low-level authenticated access to the application, which meaningfully constrains opportunistic abuse. Impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change, consistent with a classic SQL injection that exposes or manipulates database contents rather than yielding full system compromise. Exploit maturity is Proof-of-Concept (E:P), and a public exploit reference exists, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - the POC should be treated as a capability, not confirmed in-the-wild use. The dominant mitigating factor is product footprint: itsourcecode projects are student/hobby PHP source-code packages, so even a trivially exploitable flaw has little aggregate internet exposure. Net assessment: a genuine vulnerability with a working POC, but low priority relative to high-severity flaws in widely deployed software - prioritize only if this specific application is confirmed in your environment.

An authenticated low-privilege user of the Baptism Information Management System submits a crafted value in the b_id parameter to pbaptism.php, injecting SQL that the application concatenates into a database query. A public proof-of-concept exists (referenced via a GitHub issue), so the attacker can adapt it directly to enumerate or alter baptism records and potentially extract other database contents. Because the CVSS complexity is Low and the vector is network-based, exploitation is straightforward once the attacker has valid application credentials.