A security vulnerability has been detected in itsourcecode Baptism Information Management System 1

itsourcecode's *Baptism Information Management System* is a free downloadable PHP/MySQL learning project distributed from itsourcecode.com as a teaching artifact for computer-science students. Version 1.0 is the only version that exists. CVE-2026-13551 (CWE-74, injection — almost certainly SQL injection in a parameterized endpoint, consistent with the dozens of near-identical VulDB-issued CVEs against this same codebase, e.g. CVE-2025-10404 / 10405 in rptbaptismal.php) lets an unauthenticated remote attacker tamper with a request parameter to extract or modify data.

Vendor CVSS of 7.3 HIGH is technically defensible in isolation — network reach, no auth, no UI, partial CIA impact. But in the real world this score is meaningless. The codebase has no commercial deployments, no vendor security program, no patch pipeline, and an effectively zero enterprise installed base. It exists on GitHub forks and student laptops. Treating it as a HIGH on a corporate patch register is noise. The honest verdict is *not on your fleet — and if it is, you have a shadow-IT problem, not a CVE problem*.

Why this verdict

• Installed base near zero: itsourcecode ships free student PHP projects; Shodan/FOFA show negligible enterprise exposure. The CVSS score assumes a target population that doesn't exist in corporate networks.
• No patch, no vendor: itsourcecode.com runs no security response. Even if you wanted to remediate in place, there is nothing to apply — the only fix is *remove the application*.
• Role multiplier — none applies: The component is not an identity provider, hypervisor, PAM, backup, CA, kernel agent, network edge, SIEM, or OT controller. There is no high-value-role deployment of a baptism register. Blast radius caps at the single database of the app itself.
• Pattern recognition: This is the Nth CVE in a long series of VulDB-issued findings against the same tutorial codebase (CVE-2025-10404, 10405, and family). Each is technically a real bug; none has ever shown enterprise impact.
• Friction audit: Unauth + network reach is real, but conditional on *the application existing on your network*. For 99.99% of defenders that condition is false — which collapses risk to zero.

Why not higher?

MEDIUM or HIGH would imply this software meaningfully exists in enterprise estates. It does not. There is no KEV listing, no exploitation telemetry, no commercial scanner signature pressure, and the impact is bounded to a single small PHP app's database.

Why not lower?

We don't go below IGNORE. If by some accident this is running in your environment, the right answer is still *remove it*, not *patch it* — IGNORE is the correct bucket because the action is binary, not a severity-graded patch cycle.

1. Inventory check — confirm absence — Run a one-time asset query for any host serving the itsourcecode Baptism IMS (file path /baptismal/, banner Baptism Information Management System). If nothing returns, document a no-op verdict and close. No mitigation SLA applies — IGNORE bucket.
2. If found, remove — don't patch — There is no upstream patch. Delete the application, revoke its DB credentials, and migrate any real data to a supported platform. Treat this as a shadow-IT cleanup, not a vulnerability remediation.
3. Block at WAF if removal is delayed — If you must keep the app online briefly during data migration, front it with a WAF (AWS WAF SQLi managed rule, Cloudflare OWASP ruleset, or ModSecurity CRS paranoia ≥2) to neutralize the trivial SQLi pattern in transit.
4. Add the itsourcecode product family to your asset deny-list — Add itsourcecode.com-sourced projects to your shadow-IT detection rules so future tutorial-grade deployments are flagged at procurement / code-review time rather than turning into a steady CVE drip.

Run on any auditor workstation that can reach internal HTTP endpoints, or schedule against your asset inventory. Invoke as ./check_baptism_ims.sh targets.txt where targets.txt is one http(s)://host[:port] per line. No special privileges required — pure HTTP probing.

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-13551
# itsourcecode Baptism Information Management System 1.0 — presence check
# Exit codes: 0 = PATCHED (not present anywhere), 2 = VULNERABLE (instance found), 3 = UNKNOWN
set -u

if [[ $# -lt 1 ]]; then
  echo "usage: $0 <targets.txt>" >&2
  exit 3
fi

TARGETS="$1"
if [[ ! -r "$TARGETS" ]]; then
  echo "cannot read $TARGETS" >&2
  exit 3
fi

PATHS=("/baptismal/" "/baptismal/login.php" "/baptismal/rptbaptismal.php" "/Baptism/" "/bims/")
MARKERS=("Baptism Information Management System" "rptbaptismal" "itsourcecode")
FOUND=0

while IFS= read -r base; do
  [[ -z "$base" || "$base" =~ ^# ]] && continue
  for p in "${PATHS[@]}"; do
    url="${base%/}${p}"
    body=$(curl -sk --max-time 8 -A "noisgate-verifier/1.0" "$url" || true)
    for m in "${MARKERS[@]}"; do
      if grep -qiF "$m" <<< "$body"; then
        echo "VULNERABLE  $url  (marker: $m)"
        FOUND=1
        break 2
      fi
    done
  done
done < "$TARGETS"

if [[ $FOUND -eq 1 ]]; then
  echo "RESULT: VULNERABLE — itsourcecode Baptism IMS instance(s) detected. Remove, do not patch."
  exit 2
fi

echo "RESULT: PATCHED — no itsourcecode Baptism IMS instance found in supplied targets."
exit 0

Sources

1. CISA Vulnerability Summary — Week of Jan 12, 2026
2. CVE-2025-10404 — sibling SQLi in same itsourcecode Baptism IMS codebase
3. CVE-2025-10405 — sibling vulnerability, same product
4. Feedly — Latest itsourcecode vulnerabilities feed
5. VulDB — CVE database (typical CNA for itsourcecode disclosures)
6. OpenCVE — CVE search
7. GitHub Advisory Database
8. CWE-74 — Improper Neutralization of Special Elements in Output ('Injection')