SourceCodester Train Station Ticketing System 1.0 contains an SQL injection vulnerability in the /ajax.php?action=save_station endpoint. Manipulating the id or station parameters can lead to unauthorized database queries. The vulnerability can be exploited remotely and public exploit code is available. The CVSS score is 6.3, indicating a medium severity impact.