CVE-2025-10405: Baptism Management System SQLi Flaw

CVE-2025-10405 Overview

CVE-2025-10405 is a SQL injection vulnerability in itsourcecode Baptism Information Management System 1.0. The flaw exists in /listbaptism.php, where the bapt_id parameter is passed directly into a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements against the backend database.

The vulnerability requires no authentication and no user interaction. A public exploit disclosure exists, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact
Remote attackers can read, modify, or delete database records by injecting SQL through the bapt_id parameter on /listbaptism.php, potentially exposing parish records and administrative credentials.

Affected Products

itsourcecode Baptism Information Management System 1.0
Vulnerable endpoint: /listbaptism.php
Vulnerable parameter: bapt_id

Discovery Timeline

2025-09-14 - CVE-2025-10405 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10405

Vulnerability Analysis

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output). The listbaptism.php script accepts the bapt_id argument from an HTTP request and concatenates it into a SQL query. Because the application does not use parameterized statements or input validation, attackers can break out of the intended query context.

Exploitation occurs over the network with low complexity. The exploit has been publicly disclosed, meaning detection signatures and attack payloads circulate openly. The EPSS probability remains low, but public PoC availability shifts risk for any internet-facing deployment.

Root Cause

The root cause is unsanitized user input flowing directly into a SQL query string. The bapt_id parameter — likely intended to identify a baptism record by numeric ID — is interpolated without type casting, prepared statements, or escaping. Standard SQL injection techniques such as UNION-based extraction, boolean-based blind injection, and stacked queries apply.

Attack Vector

The attack vector is remote and unauthenticated. An attacker sends a crafted HTTP GET or POST request to /listbaptism.php with a malicious bapt_id value. Successful injection allows enumeration of database schemas, extraction of stored records, and modification or deletion of data. Where the database user holds file privileges, attackers may also read local files or write web shells.

No verified exploit code is reproduced here. Technical details are tracked in the GitHub Issue Discussion and VulDB #323840.

Detection Methods for CVE-2025-10405

Indicators of Compromise

HTTP requests to /listbaptism.php containing SQL metacharacters in the bapt_id parameter, such as single quotes, UNION SELECT, OR 1=1, or comment sequences -- and #.
Web server access logs showing unusually long bapt_id values or encoded payloads such as %27 and %20UNION%20.
Database error messages returned in HTTP responses referencing MySQL syntax or column counts.
Unexpected outbound database queries against information_schema, mysql.user, or other system tables.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the bapt_id parameter for SQL injection patterns and block non-numeric input.
Enable database query logging and alert on queries originating from the application that reference system catalog tables.
Correlate authentication failures and abnormal record access with preceding requests to /listbaptism.php.

Monitoring Recommendations

Monitor web server logs for spikes in 500-series responses tied to /listbaptism.php, which often indicate injection probing.
Track database account activity for unusual SELECT volumes or queries returning large result sets.
Alert on any HTTP request to listbaptism.php where bapt_id is not strictly numeric.

How to Mitigate CVE-2025-10405

Immediate Actions Required

Restrict network access to the Baptism Information Management System using firewall rules or VPN-only access until a fix is applied.
Apply server-side input validation to enforce a strict numeric type on the bapt_id parameter.
Review database logs for evidence of prior exploitation, including unexpected schema queries or data exports.
Rotate database credentials and any application secrets that may have been exposed.

Patch Information

No vendor advisory or official patch has been published for itsourcecode Baptism Information Management System 1.0 at the time of NVD listing. Organizations running this application should treat it as unsupported and plan migration or compensating controls. Refer to VulDB CTI ID #323840 for ongoing tracking.

Workarounds

Replace the vulnerable query with a parameterized prepared statement, binding bapt_id as an integer.
Deploy a WAF in front of the application with a signature blocking SQL injection payloads targeting bapt_id.
Run the application database account with the least privilege necessary, denying access to information_schema and administrative tables where possible.
Disable the /listbaptism.php endpoint if it is not required for production use.

bash

# Example Apache mod_rewrite rule to reject non-numeric bapt_id values
RewriteEngine On
RewriteCond %{QUERY_STRING} (^|&)bapt_id=([^0-9&]|.*[^0-9&].*) [NC]
RewriteRule ^listbaptism\.php$ - [F,L]