Is there any possibility to make a successful verification with just modifying message and signature, and without modifying public-key ?
One would certainly hope not. If you can, then you've just shown that the signature algorithm used is broken, and not to be trusted.
For a signature method to be considered secure, then it is required that someone without the private key cannot somehow cobble up a signature to any message that has not be specifically signed by someone else with the private key. The attacker is allowed access to valid signed messages (and we even allow him to pick the messages to be signed). If he could take a valid message and signature, and somehow alter the message, and come up with a valid signature, he has just violated the security property of the signature.
Now, you do use SHA-1 as the hash function - what this means is that it is believed to be feasible (nobody has actually done it and published it) to create two messages that has the same SHA-1 hash; if he then gets one signed, then that signature would be a valid signature to the other message. Because of this, we're urging people to use a stronger hash (such as one of the SHA-2 or SHA-3 hashes). I bring this up because this is the one known way (assuming that your RSA key is strong) that someone could generate a forgery with what you are doing.