Executive brief
The Baptism Information Management System, a software used for managing religious records, contains a security flaw that allows unauthorized individuals to manipulate its database. By sending a specially crafted web request, an attacker can view, modify, or delete sensitive information without needing a username or password. This could lead to a total loss of data integrity and unauthorized access to private records.
Technical details
A SQL injection vulnerability exists in itsourcecode Baptism Information Management System 1.0 within the 'delbaptism.php' file. The root cause is the improper neutralization of the 'id' GET parameter, which is directly concatenated into SQL queries without sanitization or prepared statements. A remote, unauthenticated attacker can exploit this by sending crafted HTTP requests to execute arbitrary SQL commands. This can lead to unauthorized data retrieval (including time-based blind injection), data modification, or full database compromise. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- itsourcecode Baptism Information Management System 1.0
Timeline
- 2026-05-30: disclosed: Initial disclosure on GitHub by researcher Hh-176
- 2026-06-29: advisory: NVD publication date