Rail Pass Management System version 1.0 suffers from a remote time-based SQL injection vulnerability.