The vulnerability occurs when an attacker manipulates the teacher_id parameter in the College Management System’s /admin/display-teacher.php page, allowing a classic SQL injection attack. This flaw is a direct consequence of insecure query construction, as indicated by the associated CWE-74 (SQL Injection via Concatenated Input) and CWE-89 (SQL Injection). Successful exploitation could compromise the confidentiality and integrity of the system’s data, enabling an attacker to retrieve, modify, or delete teacher records and potentially other sensitive information stored in the underlying database.

itsourcecode College Management System version 1.0 is affected. The vulnerability resides in the admin module that processes teacher identifiers.

The CVSS base score of 5.3 indicates moderate severity, but the EPSS rating of less than 1% shows a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, reducing the likelihood that a widespread exploit is actively being used. The attack vector is clearly remote, as the flaw is triggered via an external HTTP request to the display-teacher.php endpoint; however, the specific authentication or authorization requirements are not detailed, so the impact range is potentially limited to users who can access the admin area.