The vulnerability resides in an unspecified section of the ebaptism.php script of itsourcecode Baptism Information Management System. By manipulating the ID argument supplied to that script, an attacker can inject arbitrary SQL commands. This flaw allows remote attackers to execute malicious SQL statements against the underlying database, potentially compromising data confidentiality, integrity, and availability. The weakness is a classic input validation failure (CWE-74) combined with improper query construction (CWE-89).

The affected product is itsourcecode Baptism Information Management System version 1.0. The vulnerability exists in the ebaptism.php component, and any deployment of this version is at risk if the vulnerable script is exposed to network traffic.

The CVSS score of 5.3 indicates moderate risk. The EPSS score is not available, so the precise exploitation probability cannot be quantified, and the vulnerability has not been listed in the CISA KEV catalog. The flaw can be exploited remotely via crafted requests to ebaptism.php. In the absence of mitigation, an attacker with network access to the application could exploit the injection to read, modify, or delete database records belonging to the baptism information system.