A flaw in the College Management System 1.0 allows an attacker to manipulate the teacher_id argument in /admin/teacher-salary.php, resulting in a SQL injection. The vulnerability is categorized as CWE-74 and CWE-89 and enables the attacker to execute arbitrary SQL statements. The data exposed or altered could include teacher salary records, potentially leading to significant confidentiality and integrity breaches.

The affected product is College Management System 1.0 from itsourcecode. All installations of version 1.0 that include the /admin/teacher-salary.php script are vulnerable. No other versions were specifically mentioned.

The CVSS score of 6.9 reflects a moderate impact. The EPSS score of less than 1% indicates a low likelihood of exploitation; however, the vulnerability is listed as not in KEV. The likely attack vector is remote, as the description states that the attack can be initiated remotely. While the requirement for authentication is not explicitly stated, it is inferred that access to /admin/teacher-salary.php may require administrative privileges, meaning an attacker may need a valid admin session or the application may be exposed to unauthenticated users. The exploit is published and reported as potentially used, so the risk persists until the vulnerability is mitigated.