The vulnerability resides in the pbaptism.php component of itsourcecode Baptism Information Management System. By manipulating the b_id argument a malicious user can inject arbitrary SQL code. This allows an attacker to read, modify, or delete data persisted in the underlying database. The impact is limited to database confidentiality and integrity and is achieved through a remote web request.

The affected product is itsourcecode Baptism Information Management System, version 1.0. Only this version is confirmed to be vulnerable. No other versions or components are known to be impacted.

The CVSS score of 5.3 indicates moderate overall risk. The EPSS score is not available, so the current likelihood of exploitation is uncertain, but the presence of a publicly available exploit suggests potential abuse. The vulnerability can be triggered remotely via HTTP requests, and it is listed as not present in the CISA KEV catalog.