SourceCodester Train Station Ticketing System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=save_user endpoint. Manipulation of the Username parameter can lead to SQL injection attacks. The vulnerability can be exploited remotely and exploit code has been published. The CVSS score is 6.3, indicating a medium severity risk.