EUVD-2026-97821
GHSA-x9j3-m337-gm3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege web access
-
DeliverySend request to ebaptism.php
-
ExploitInject SQL via ID parameter
-
ExecutionManipulate backend database query
-
ImpactRead or alter baptism records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the application's ebaptism.php endpoint plus a low level of existing privilege (CVSS PR:L), indicating the attacker must reach an authenticated or otherwise privileged context rather than attacking a fully anonymous surface. The specific prerequisite is the ability to supply the ID parameter to ebaptism.php, which is passed unsanitized into a SQL query. Limiting factors: the PR:L requirement means a valid (even if low-tier) account or session is needed, and the practical blast radius is constrained by the product's tiny, non-production deployment base; no special non-default configuration is called out in the description. |
| Impact | Despite CVE-level tracking, the real-world risk of this issue is low. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, with all impact metrics rated low (VC:L/VI:L/VA:L) and no subsequent-system impact - consistent with VulDB's characteristically conservative scoring of small PHP applications. Exploitation requires network reach but also some level of existing privilege (PR:L), so it is not an unauthenticated drive-by. A public exploit exists (POC=YES, referenced GitHub issue), and the vector flags E:P (proof-of-concept), which raises the practical likelihood of opportunistic use, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation. The dominant mitigating factor is prevalence: itsourcecode products are student/tutorial-grade PHP projects with negligible production deployment. Net: a genuine SQL injection flaw (CWE-89) with public PoC, but low CVSS, low privilege-adjacent impact, and a tiny install base make this a low priority rather than an urgent threat. Note the signals are internally consistent (low CVSS + PoC-only exploitation maturity), so no major conflict to flag beyond the absence of EPSS/KEV data. |
| Exploit ScenarioDerived | An attacker with low-level access to the Baptism Information Management System web interface sends a request to ebaptism.php with a crafted ID parameter containing SQL metacharacters. Because the ID argument is concatenated into a database query without sanitization, the attacker reads or manipulates backend database records. A public proof-of-concept for this exact parameter is already available, lowering the skill needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
SQL injection in itsourcecode Baptism Information Management System 1.0 allows an attacker who already holds a low-privileged session to manipulate the ID argument of ebaptism.php and inject arbitrary SQL into the backend query, potentially exposing or altering records such as baptism registrations. Publicly available exploit code exists - a proof-of-concept was published in a public GitHub issue tied to the VulDB report - but there is no confirmed active exploitation (CISA KEV). The vendor-scored CVSS 4.0 base value is 2.1 with E:P, and an independent assessment rates the real-world risk as low because exploitation requires network reach plus a low-privileged authenticated context and the product has a very small, largely non-production deployment base.
RemediationAI
No vendor-released patch or fixed version is identified in the available data - the references contain no vendor advisory and the CPE version is a wildcard - so remediation must rely on compensating controls until itsourcecode publishes a fix. Highest-value action: modify ebaptism.php so the ID parameter is handled with a prepared statement/parameterized query (or, at minimum, strict integer casting and a whitelist), verifying the value is numeric before it reaches the SQL layer; this removes the injection class entirely but requires source access and regression testing of the baptism-record views. Where the application must stay online unpatched, place it behind an authenticating reverse proxy or restrict ebaptism.php to trusted source networks/VPN (the attack already requires a low-privileged session per PR:L, so tightening account provisioning and session issuance meaningfully raises the bar) - the trade-off is reduced usability for legitimate remote staff. Deploy a WAF rule set targeting SQL metacharacters in the ID parameter on ebaptism.php as a short-term containment layer, accepting that WAF bypass is possible and it is not a substitute for code fixes. Additionally, since the product has a tiny deployment base and this is unlikely to be an internet-facing production system, consider taking the instance offline or migrating records to a maintained application; audit database logs for anomalous queries against baptism tables, and cap the database account used by the application to the minimum privileges needed so a successful injection cannot reach unrelated schemas.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP web application (itsourcecode Baptism Information Management System 1.0) whose ebaptism.php script accepts an ID argument and passes it into a SQL statement without proper neutralization of special elements. That root-cause class is CWE-89 (SQL Injection): user-controllable input is concatenated or otherwise interpolated into a query rather than bound through parameterized statements or prepared statements, letting an attacker reshape the query logic. The reported CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, E:P, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N) indicates a network-reachable, no-special-conditions attack that requires a low level of prior privilege and produces only limited confidentiality, integrity and availability impact confined to the vulnerable component, with subsequent-system impact explicitly none. The independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, consistent with a low-severity injection reachable by a low-tier account. The CPE entry cpe:2.3:a:itsourcecode:baptism_information_management_system:*:*:*:*:*:*:*:* uses a wildcard version, so all 1.0 releases of the product should be assumed affected; the issue was reported through VulDB.
Know when Baptism Information Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote SQLi over the network (AV:N/AC:L) but the vendor vector requires existing low privilege (PR:L), with limited database read/write impact rated low across C/I/A.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in itsourcecode Baptism Information Management System 1.0 exposes database contents to remote unauthentica
SQL injection in itsourcecode Baptism Information Management System 1.0 exposes the `/delbaptism.php` endpoint to remote
A vulnerability was determined in itsourcecode Baptism Information Management System 1.0. Rated medium severity (CVSS 6.
A vulnerability was found in itsourcecode Baptism Information Management System 1.0. Rated medium severity (CVSS 6.9), t
Authenticated SQL injection in itsourcecode Baptism Information Management System 1.0 allows a low-privilege, logged-in
Exploit-DB