EUVD-2026-40055
GHSA-h955-4hrr-wr38
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered unauthenticated SQL injection; no scope change as impact is contained to the application's own database; partial C/I/A reflecting limited data exposure and modification.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impacted element is an unknown function of the file /delbaptism.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
SQL injection in itsourcecode Baptism Information Management System 1.0 exposes the /delbaptism.php endpoint to remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this requires no authentication or user interaction against any network-accessible instance. A public proof-of-concept exploit exists on GitHub, making this immediately weaponizable against any exposed deployment, though the application is not listed in CISA KEV and its niche footprint substantially limits aggregate exposure.
Technical ContextAI
The vulnerability is a classic SQL injection (CWE-89) in a PHP-based church and baptism records management application developed by itsourcecode. The affected PHP script /delbaptism.php interpolates the attacker-controlled ID request parameter directly into a SQL query without using parameterized statements or prepared queries, a fundamental OWASP A03 injection failure. The CPE string cpe:2.3:a:itsourcecode:baptism_information_management_system:*:*:*:*:*:*:*:* uses a wildcard version, indicating NVD has not constrained the affected range beyond the broadly referenced version 1.0. itsourcecode PHP applications of this type typically target MySQL backends, meaning common SQLi techniques such as UNION-based extraction, boolean-blind inference, and stacked queries may be applicable depending on the database configuration and PHP MySQLi/PDO usage.
RemediationAI
No vendor-released patch has been identified at time of analysis; itsourcecode has not published a security advisory or patched release. The primary remediation is to refactor /delbaptism.php to replace direct SQL string interpolation of the ID parameter with PHP PDO or MySQLi prepared statements with bound parameters - this eliminates the injection root cause. As an immediate compensating control, restrict access to the application to trusted IP ranges or place it behind an authentication gateway, since the vulnerable endpoint requires no credentials to reach. Deploying a WAF rule targeting SQL injection patterns on the /delbaptism.php path can reduce automated exploitation risk, though WAF rules carry false-positive risk on legitimate numeric ID values and should be tested before enforcing. If the application is not actively used, taking it offline is the lowest-risk option. Monitor the VulDB entry at https://vuldb.com/vuln/374558 for patch availability.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today