CVE-2026-13550: SQL Injection in itsourcecode Baptism Information Management System 1.0

Technical summary

CVE-2026-13550 is a remote SQL injection vulnerability (CWE-89) in itsourcecode Baptism Information Management System 1.0. The /delbaptism.php script fails to properly sanitize or parameterize the ID parameter before incorporating it into SQL queries. An attacker can exploit this by submitting crafted input containing SQL metacharacters to the vulnerable parameter. The underlying weakness (CWE-74: Improper Neutralization of Special Elements) indicates insufficient input validation. The attack vector is network-based with low complexity, requires no privileges or user interaction, and impacts the confidentiality, integrity, and availability of the affected system. CVSS 3.1 score of 7.3 reflects this HIGH severity profile.

Business impact

Organizations deploying itsourcecode Baptism Information Management System 1.0 face significant risk of data compromise. Attackers exploiting this vulnerability can access, alter, or destroy baptism records and any associated personal information stored in the database. For religious institutions or civil agencies managing sacramental records, this creates compliance and legal exposure, potential reputational harm, and operational disruption. The availability of public exploits and lack of KEV designation does not eliminate urgency—it underscores the need for rapid remediation before active abuse scales.

Affected systems

itsourcecode Baptism Information Management System version 1.0 is confirmed affected. The vulnerability is located in the /delbaptism.php file and is triggered through manipulation of the ID parameter. No other product versions or vendors are listed in available advisories, but organizations should verify their installed version and configuration with the vendor to confirm exposure.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and no complex exploitation techniques. An attacker can craft a simple HTTP request with a malicious ID parameter to execute arbitrary SQL. Public exploit code is already available, and the low attack complexity (AC:L) means even unsophisticated attackers can attempt exploitation. Network accessibility and absence of privilege requirements make this vulnerability immediately actionable for any threat actor who identifies a running instance.

Remediation

Apply a patch or upgrade provided by itsourcecode for the Baptism Information Management System. Verify the patched version number against the official vendor advisory. If a patch is not yet available, implement input validation and parameterized queries (prepared statements) in the affected /delbaptism.php file, or disable or restrict access to that endpoint until a fix is deployed. Additionally, review database access controls and enable comprehensive logging of SQL queries to detect exploitation attempts.

Patch guidance

Contact itsourcecode directly or check their security advisories for an available patch to version 1.0 or later. Patch deployment should be prioritized given the HIGH severity score and public exploit availability. Before applying any patch, test in a non-production environment to ensure functionality and compatibility with your organization's configuration. Once patched, restart the application service and verify that the /delbaptism.php parameter handling is no longer vulnerable by retesting with security scanning tools.

Detection guidance

Monitor web server logs for HTTP requests to /delbaptism.php containing suspicious characters in the ID parameter, such as single quotes, double dashes, semicolons, UNION keywords, or other SQL metacharacters. Implement intrusion detection system (IDS) rules to flag SQL injection patterns targeting this endpoint. Enable database query logging to identify unusual or unauthorized SQL statements executed against the baptism records table. Look for failed or successful DELETE operations on unexpected data, as well as SELECT statements probing for system information. Conduct regular vulnerability scans against the system to confirm patch status.

Why prioritize this

This vulnerability merits immediate attention due to the combination of HIGH CVSS score (7.3), public exploit availability, lack of authentication barriers, network accessibility, and direct impact on data integrity and confidentiality. The religious and personal nature of baptism records elevates the reputational and legal consequences of breach. Although not yet on CISA's KEV list, the public exploit code and straightforward attack vector mean active exploitation is likely if patching is delayed.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH severity rating based on the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Network Attack Vector (AV:N) and Low Attack Complexity (AC:L) indicate ease of remote exploitation. No Privilege Requirement (PR:N) and No User Interaction (UI:N) mean any unauthenticated attacker can trigger the flaw. Limited impact to Confidentiality, Integrity, and Availability (L across all three) reflects that the vulnerability allows unauthorized data access and modification but does not fully compromise all data or the system's core operation. The overall score balances ease of exploitation against moderate damage scope.

Frequently asked questions