CVE-2025-10404: Baptism Information Management SQLI Flaw

CVE-2025-10404 Overview

A SQL Injection vulnerability has been identified in itsourcecode Baptism Information Management System version 1.0. This vulnerability affects the /rptbaptismal.php file, where improper handling of the ID parameter allows remote attackers to inject malicious SQL commands. The exploit has been publicly disclosed and can be leveraged remotely without authentication.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to read, modify, or delete database contents, potentially compromising all sensitive baptismal records and system data stored in the application.

Affected Products

• itsourcecode Baptism Information Management System 1.0

Discovery Timeline

• 2025-09-14 - CVE CVE-2025-10404 published to NVD
• 2025-09-18 - Last updated in NVD database

Technical Details for CVE-2025-10404

Vulnerability Analysis

This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected application fails to properly sanitize user-supplied input to the ID parameter in the /rptbaptismal.php endpoint before incorporating it into SQL queries.

SQL injection vulnerabilities of this nature allow attackers to bypass application logic and directly interact with the backend database. In this case, the application likely constructs dynamic SQL queries by concatenating the ID parameter value without proper parameterization or escaping, enabling attackers to inject arbitrary SQL syntax.

Root Cause

The root cause of this vulnerability is the lack of input validation and parameterized queries in the /rptbaptismal.php file. When user input from the ID parameter is directly embedded into SQL statements without sanitization, it creates an injection point that attackers can exploit. The application does not implement prepared statements or input filtering mechanisms to prevent malicious SQL code from being executed.

Attack Vector

The attack can be performed remotely over the network without requiring authentication. An attacker can craft malicious HTTP requests to the /rptbaptismal.php endpoint with specially crafted ID parameter values containing SQL injection payloads. These payloads can manipulate the underlying SQL query to extract data, modify records, or potentially execute administrative operations on the database.

The vulnerability allows for various SQL injection techniques including UNION-based attacks to extract data from other tables, boolean-based blind injection to infer database contents, and time-based blind injection for scenarios where direct output is not visible. For detailed technical analysis, refer to the GitHub Issue Discussion.

Detection Methods for CVE-2025-10404

Indicators of Compromise

• Suspicious HTTP requests to /rptbaptismal.php containing SQL syntax characters such as single quotes, semicolons, UNION statements, or comment sequences
• Database error messages appearing in application logs or HTTP responses that reveal SQL query structure
• Unusual database query patterns including SELECT statements accessing multiple tables or attempting to enumerate database schema

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the ID parameter
• Implement application-level logging to capture all requests to /rptbaptismal.php and flag those containing suspicious characters or encoded payloads
• Monitor database query logs for anomalous queries originating from the web application, particularly those with unusual syntax or targeting system tables

Monitoring Recommendations

• Enable detailed access logging on the web server to capture full request URIs and parameter values for the vulnerable endpoint
• Configure intrusion detection systems (IDS) to alert on SQL injection attack signatures targeting PHP applications
• Establish baseline normal behavior for database queries and alert on deviations that may indicate exploitation attempts

How to Mitigate CVE-2025-10404

Immediate Actions Required

• Restrict access to /rptbaptismal.php by implementing network-level access controls or authentication requirements until a patch is applied
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules enabled for the affected application
• Review and audit all instances of Baptism Information Management System in your environment to identify vulnerable deployments

Patch Information

At the time of this publication, no official patch information has been released by the vendor. Organizations should monitor the IT Source Code website for updates and security advisories. Additional technical details and vulnerability tracking information are available through VulDB #323839.

Workarounds

• Implement input validation on the ID parameter to accept only numeric values, rejecting any requests containing non-numeric characters
• Modify the application code to use parameterized queries or prepared statements instead of string concatenation for SQL query construction
• Consider taking the application offline or restricting access to trusted networks until the vulnerability can be properly remediated

# Example: Apache .htaccess rule to restrict access to vulnerable endpoint
<Files "rptbaptismal.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Files>