CVE-2026-13550: Baptism Management System SQLi Flaw

CVE-2026-13550 Overview

CVE-2026-13550 is a SQL injection vulnerability in itsourcecode Baptism Information Management System 1.0. The flaw resides in the /delbaptism.php script, where the ID argument is passed to a database query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output). Public disclosure of exploitation details has occurred, increasing the likelihood of opportunistic attacks against exposed instances.

Critical Impact
Unauthenticated remote attackers can inject SQL through the ID parameter of /delbaptism.php, enabling unauthorized data access, modification, or deletion in the underlying database.

Affected Products

itsourcecode Baptism Information Management System 1.0
Component: /delbaptism.php
Vulnerable parameter: ID

Discovery Timeline

2026-06-29 - CVE-2026-13550 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13550

Vulnerability Analysis

The vulnerability exists in the /delbaptism.php endpoint of the Baptism Information Management System. The script accepts an ID value through an HTTP request and passes it directly into a SQL statement used to delete or query baptism records. Because the input is not validated, escaped, or bound as a parameter, attackers can append SQL syntax to alter the query logic.

The attack can be performed over the network without authentication or user interaction. According to VulDB, proof-of-concept details have been made public, lowering the barrier for exploitation. The CWE-74 classification indicates a broader injection pattern where untrusted input is embedded in a downstream interpreter, in this case a SQL engine. The EPSS probability is 0.263% at the 17.676 percentile as of 2026-07-02.

Root Cause

The root cause is direct concatenation of the user-supplied ID parameter into a SQL query inside /delbaptism.php. The application does not use prepared statements or parameterized queries, nor does it enforce type checks that would restrict ID to a numeric value.

Attack Vector

An attacker sends a crafted HTTP request to /delbaptism.php with a malicious ID value containing SQL metacharacters and payloads. Successful injection can enumerate the database schema, extract records, modify data, or destroy baptism records. Because no authentication is required, any network-reachable instance is exposed. See the VulDB CVE Details and GitHub Issue CVE Discussion for further technical context.

Detection Methods for CVE-2026-13550

Indicators of Compromise

HTTP requests to /delbaptism.php containing SQL keywords such as UNION, SELECT, SLEEP, OR 1=1, or comment sequences (--, #) in the ID parameter.
Unexpected database errors or lengthy response times originating from /delbaptism.php.
Sudden changes in the baptism table row count or missing records without corresponding administrative activity.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL syntax patterns in the ID parameter of /delbaptism.php.
Enable database query logging and alert on suspicious query structures such as stacked statements or tautologies referencing baptism tables.
Correlate web server access logs with database audit logs to identify injection attempts followed by anomalous query execution.

Monitoring Recommendations

Monitor for repeated 500-series HTTP responses from /delbaptism.php, which often signal blind SQL injection probing.
Track outbound connections from the database host that could indicate exfiltration following exploitation.
Baseline normal request patterns for the application and alert on requests originating from non-administrative IP ranges.

How to Mitigate CVE-2026-13550

Immediate Actions Required

Restrict network access to the Baptism Information Management System to trusted administrative networks or VPN users only.
Disable or remove the /delbaptism.php endpoint if it is not required for current operations.
Review database and web server logs for prior exploitation attempts and validate the integrity of baptism records.

Patch Information

At the time of publication, no vendor-issued patch is referenced in the CVE record. Administrators should monitor the IT Source Code project page for updates and consult the VulDB Vulnerability Overview for advisory changes.

Workarounds

Implement server-side input validation that restricts the ID parameter to integers before it reaches the database layer.
Refactor /delbaptism.php to use parameterized queries or prepared statements via PDO or mysqli with bound parameters.
Deploy a WAF ruleset that blocks common SQL injection payloads targeting the vulnerable endpoint.
Enforce least-privilege database accounts so the web application cannot execute destructive operations beyond its required scope.

bash

# Example: WAF rule concept (ModSecurity) to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /delbaptism.php" \
    "id:1013550,phase:2,deny,status:403,\
    chain,msg:'Potential SQLi against Baptism IMS (CVE-2026-13550)'"
    SecRule ARGS:ID "@rx (?i)(union(\s|/\*.*\*/)+select|or\s+1=1|sleep\(|--|#|;)" "t:none"