Description
A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impacted element is an unknown function of the file /delbaptism.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-06-29
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a SQL injection flaw in the delbaptism.php entry point of the Baptism Information Management System. Manipulating the ID argument allows an attacker to inject arbitrary SQL code, enabling unauthorized reading or modification of baptism records. The flaw is exploitable remotely via the web interface and has a publicly available exploit, meaning that the potential impact includes loss of confidentiality and integrity of sensitive personal data.

Affected Systems

The affected product is itsourcecode Baptism Information Management System, version 1.0. No other affected versions are listed in the supplied information. The flaw resides specifically within the delbaptism.php component.

Risk and Exploitability

The CVSS score is 6.9, denoting moderate severity. EPSS is not available, but the presence of a public exploit indicates a tangible risk. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint remotely over HTTP by supplying a crafted ID parameter, which the application fails to sanitize.

Generated by OpenCVE AI on June 29, 2026 at 09:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor's latest patch for the Baptism Information Management System as soon as it becomes available.
  • If a patch is not yet released, sanitize the ID parameter by enforcing type checks or by using prepared statements to eliminate injection vectors.
  • Restrict access to the delbaptism.php endpoint to authenticated users with the appropriate deletion rights and monitor web logs for suspicious activity.

Generated by OpenCVE AI on June 29, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 29 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 08:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impacted element is an unknown function of the file /delbaptism.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Baptism Information Management System delbaptism.php sql injection
First Time appeared Itsourcecode
Itsourcecode baptism Information Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:baptism_information_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode baptism Information Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Baptism Information Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-29T13:51:21.401Z

Reserved: 2026-06-28T11:03:51.237Z

Link: CVE-2026-13550

cve-icon Vulnrichment

Updated: 2026-06-29T13:51:15.479Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-29T13:45:07Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')