SourceCodester Train Station Ticketing System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=login endpoint. The vulnerability arises from improper handling of the Username argument, allowing remote attackers to manipulate SQL queries. Public exploit code is available for this vulnerability. The CVSS 3.1 base score is 7.3, indicating a high severity impact with potential confidentiality, integrity, and availability loss.