CVE-2026-108926: Baptism Management System SQL Injection

CVE-2026-108926 Overview

CVE-2026-108926 is a SQL injection vulnerability in itsourcecode Baptism Information Management System 1.0. The flaw resides in the ebaptism.php script, where the ID parameter is incorporated into a database query without proper sanitization. Remote attackers can manipulate the parameter to execute arbitrary SQL statements against the backend database. A public exploit has been released, lowering the barrier to abuse. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated remote attackers can inject SQL into the ID parameter of ebaptism.php, enabling unauthorized access to database records in the Baptism Information Management System.

Affected Products

• itsourcecode Baptism Information Management System 1.0
• Component: ebaptism.php
• Vendor resource: IT Source Code

Discovery Timeline

• 2026-10-12 - CVE-2026-108926 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108926

Vulnerability Analysis

The vulnerability is a classic SQL injection in the ebaptism.php endpoint of the Baptism Information Management System. The application concatenates the ID request parameter directly into a SQL statement without parameterization or input validation. An attacker who can reach the application over the network and supply the ID parameter can alter the structure of the executed query. Successful exploitation enables reading, modifying, or deleting records in the backend database. According to published vulnerability data, the exploit has been publicly disclosed, which increases the likelihood of opportunistic scanning and abuse against exposed instances.

Root Cause

The root cause is improper neutralization of user-supplied input before incorporation into a SQL query. The ID parameter processed by ebaptism.php lacks server-side validation and does not use prepared statements or parameterized queries. This permits SQL metacharacters to break out of the intended query context.

Attack Vector

The attack is executed remotely over the network against the vulnerable PHP endpoint. The attacker requires low privileges, as indicated by the CVSS vector PR:L, and no user interaction. Exploitation is performed by submitting a crafted value for the ID parameter in a request to ebaptism.php.

The vulnerability is triggered by manipulating the ID parameter of ebaptism.php.
No verified proof-of-concept code is republished here.
See the GitHub Issue Report and VulDB entry for technical details:
- https://github.com/yulisec/submit/issues/1
- https://vuldb.com/vuln/416749

Detection Methods for CVE-2026-108926

Indicators of Compromise

• HTTP requests to ebaptism.php containing SQL metacharacters such as single quotes, UNION SELECT, OR 1=1, or inline comments (--, /*) in the ID parameter.
• Database error messages returned in HTTP responses referencing MySQL or MariaDB syntax errors.
• Unexpected outbound queries, large result sets, or dumps of tables such as users, admin, or baptism records.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect query string and POST parameters sent to ebaptism.php for SQL injection patterns.
• Enable database query logging and alert on anomalous queries originating from the application service account referencing system tables or information_schema.
• Correlate web server access logs with database audit logs to identify request-to-query chains that deviate from baseline application behavior.

Monitoring Recommendations

• Monitor web access logs for repeated requests to ebaptism.php?ID= with abnormal parameter length or encoded payloads.
• Alert on authentication events followed by sequential enumeration of record IDs from a single source IP.
• Track egress traffic from the web server for signs of data exfiltration after suspicious requests.

How to Mitigate CVE-2026-108926

Immediate Actions Required

• Restrict network exposure of the Baptism Information Management System to trusted networks or place it behind a VPN until a fix is applied.
• Deploy WAF signatures to block SQL injection payloads targeting the ID parameter of ebaptism.php.
• Review database and web logs for signs of exploitation attempts since the public disclosure date.

Patch Information

No official vendor patch has been published for itsourcecode Baptism Information Management System 1.0 at the time of writing. Monitor the IT Source Code website and the VulDB entry for CVE-2026-108926 for updates.

Workarounds

• Modify ebaptism.php to use parameterized queries or prepared statements (for example, PHP Data Objects with bound parameters) when handling the ID parameter.
• Enforce strict server-side validation that confirms ID is a positive integer before passing it to any SQL query.
• Apply the principle of least privilege to the database account used by the application, removing rights to drop tables or access unrelated schemas.

# Example: enforce integer-only ID parameter in PHP
# Replace vulnerable concatenation with a prepared statement
# $id = $_GET['ID'];
# $sql = "SELECT * FROM baptism WHERE id = $id"; // vulnerable

$id = filter_input(INPUT_GET, 'ID', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
    http_response_code(400);
    exit('Invalid ID');
}
$stmt = $pdo->prepare('SELECT * FROM baptism WHERE id = :id');
$stmt->execute([':id' => $id]);