Executive brief
A security vulnerability exists in the itsourcecode Baptism Information Management System, a software tool used for managing religious records. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the modification of records. This issue can be exploited remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in itsourcecode Baptism Information Management System 1.0 within the 'editBaptism.php' file. The root cause is the failure to sanitize or validate the 'id' GET parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests to manipulate SQL queries. Testing has confirmed susceptibility to boolean-based blind, time-based blind, and UNION-based SQL injection techniques. Successful exploitation allows for unauthorized database enumeration, data exfiltration, and potential system compromise. No official patch has been identified; remediation should involve implementing prepared statements and parameterized queries.
Affected products
- itsourcecode Baptism Information Management System 1.0
Timeline
- 2026-05-30: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-29: advisory: NVD publication date