CVE-2026-108927 in Baptism Information Management System
Summary
by MITRE • 10/13/2026
A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument b_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The itsourcecode Baptism Information Management System version 1.0 contains a critical security flaw within the pbaptism.php file, specifically related to how it processes input arguments passed via the b_id parameter. This vulnerability is classified as an SQL injection, which falls under CWE-89 in the Common Weakness Enumeration taxonomy. The root cause lies in the application's failure to properly sanitize or validate user-supplied data before incorporating it into database queries. When a remote attacker provides maliciously crafted input for the b_id argument, the system fails to distinguish between executable code and data, allowing the injected SQL commands to be executed by the underlying database management system. This lack of proper input validation is a fundamental design error that undermines the integrity and confidentiality of the application's backend data store.
The operational impact of this vulnerability is severe due to its remote exploitability. Attackers can initiate these attacks over a network without requiring prior authentication, significantly lowering the barrier for entry. Since an exploit has already been made publicly available, automated scanning tools and malicious actors are likely actively targeting systems running this specific version of the software. Successful exploitation allows attackers to bypass access controls, extract sensitive information such as user credentials or personal baptism records, modify database contents, or potentially execute administrative commands on the underlying server depending on the database configuration. This poses a direct threat to data privacy compliance and organizational reputation.
To mitigate this risk, immediate remediation is required by developers of the Baptism Information Management System. The primary fix involves implementing parameterized queries or prepared statements for all SQL operations involving user input, ensuring that the b_id argument is treated strictly as data rather than executable code. Additionally, applying strict input validation and output encoding practices will further reduce the attack surface. For system administrators unable to patch immediately, deploying a Web Application Firewall with rules specifically targeting SQL injection patterns can provide temporary protection against known exploit signatures. It is also recommended to review database user permissions to ensure that the application account operates with minimal privileges, limiting the potential damage even if an injection occurs.