CVE-2026-3152 is a SQL injection flaw (CVSS 7.3, high) in itsourcecode College Management System 1.0. The teacher_id parameter in /admin/teacher-salary.php is concatenated into a database query. The record says an exploit is public and names no fix, so remove the app or have its code fixed.
What's affected
itsourcecode College Management System version 1.0 is affected, as listed in the record. The affected file is /admin/teacher-salary.php, and the teacher_id parameter is the entry point. The record names no fixed version and no vendor patch.
How to check if you're exposed
Find out whether this application is deployed anywhere in your estate. Search web server paths for /admin/teacher-salary.php.
If you have the source, search the code that handles the teacher salary page for queries built by joining strings with the teacher_id value. Any hit is a problem to fix, whether or not you can match it to this CVE.
What to do now
- Take the application offline if it is not needed, or restrict it to trusted networks.
- If you must keep it, change the code to use parameterized queries for
teacher_idand every other value that reaches the database. - Run the database account with the least privilege the application needs.
- Place a web application firewall in front as a stopgap, and review logs for unusual input to
/admin/teacher-salary.php.
Why it matters
The weaknesses are CWE-74, injection, and CWE-89, SQL injection. The application builds a query by joining a request value into the text of the statement. The database cannot tell the value from the query, so a crafted value changes what the query does.
The record states the exploit was made public and that remote attack is possible. It does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Will a WAF fix this?
It can block common patterns, but it is a stopgap. The real fix is parameterized queries in the code.
Sources
Last reviewed: 19 October 2026.
