CVE-2026-108927: Baptism Management System SQL Injection

CVE-2026-108927 Overview

CVE-2026-108927 is a SQL injection vulnerability in itsourcecode Baptism Information Management System 1.0. The flaw resides in the pbaptism.php script, where the b_id parameter is passed directly into a database query without proper sanitization. Remote attackers with low-privileged access can manipulate the parameter to inject arbitrary SQL statements. Public exploit details have been disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output.

Critical Impact
Authenticated remote attackers can inject SQL through the b_id parameter in pbaptism.php, enabling unauthorized read, modification, or disclosure of baptism records stored in the backend database.

Affected Products

itsourcecode Baptism Information Management System 1.0
Vulnerable file: pbaptism.php
Vulnerable parameter: b_id

Discovery Timeline

2026-10-12 - CVE-2026-108927 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-108927

Vulnerability Analysis

The vulnerability affects the pbaptism.php component of the itsourcecode Baptism Information Management System 1.0. The script accepts the b_id request parameter and concatenates it into a SQL statement without parameterization or escaping. An attacker supplies crafted input containing SQL metacharacters, which the database engine then interprets as part of the query structure.

Successful exploitation grants read and limited write access to the backing database. Attackers can enumerate schema details, extract user credentials, and tamper with sacramental records. Because the attack targets a PHP endpoint over HTTP, exploitation requires only standard web tooling.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream SQL interpreter [CWE-74]. The pbaptism.php handler does not validate, filter, or bind the b_id parameter before including it in the generated query, allowing user input to alter the query grammar.

Attack Vector

Exploitation occurs remotely over the network. The attacker needs low-level authentication to reach the vulnerable endpoint and submits a HTTP request containing a malicious b_id value. According to VulDB, exploit details have been made public. The EPSS probability currently sits at 0.25% at the 15.182 percentile, reflecting limited observed exploitation attempts.

The vulnerability is described in prose rather than code because no verified proof-of-concept has been reproduced for this advisory. Refer to the VulDB entry for CVE-2026-108927 and the GitHub issue tracker entry for technical references.

Detection Methods for CVE-2026-108927

Indicators of Compromise

HTTP requests to pbaptism.php containing SQL metacharacters such as single quotes, UNION, SELECT, or -- in the b_id parameter.
Unexpected database errors or stack traces returned from the baptism management application logs.
Outbound queries from the application database user that enumerate information_schema tables.

Detection Strategies

Deploy web application firewall rules that inspect the b_id query parameter for SQL injection payload signatures.
Enable verbose database query logging and alert on queries that reference information_schema or system tables from the application account.
Correlate web server access logs with database audit logs to identify time-aligned anomalies tied to pbaptism.php requests.

Monitoring Recommendations

Monitor authentication activity for the baptism application and flag accounts generating abnormal request volumes to pbaptism.php.
Track response size and status code anomalies on the vulnerable endpoint that may indicate error-based or UNION-based extraction.
Review database user privileges and alert on schema reconnaissance or data exports originating from the web application tier.

How to Mitigate CVE-2026-108927

Immediate Actions Required

Restrict network access to the Baptism Information Management System to trusted internal users until a fix is applied.
Audit pbaptism.php and replace string concatenation with parameterized queries or prepared statements for the b_id parameter.
Rotate any database credentials and application accounts that may have been exposed to untrusted users.

Patch Information

No vendor-issued patch has been published for itsourcecode Baptism Information Management System 1.0 at the time of disclosure. Monitor the itsourcecode project page and the VulDB vulnerability record for updated remediation guidance.

Workarounds

Add server-side input validation that enforces a numeric type and length constraint on the b_id parameter before query execution.
Configure a web application firewall rule set, such as OWASP Core Rule Set, to block SQL injection patterns targeting pbaptism.php.
Apply least-privilege database roles so the application account cannot read system catalogs or write to unrelated tables.

bash

# Example ModSecurity rule to block SQLi attempts against the b_id parameter
SecRule REQUEST_URI "@contains /pbaptism.php" \
    "id:1026108927,phase:2,deny,status:403,\
     msg:'CVE-2026-108927 SQLi attempt on b_id',\
     chain"
    SecRule ARGS:b_id "@detectSQLi" "t:none,t:urlDecodeUni"