CVE-2017-20243

Name of the Vulnerable Software and Affected Versions WordPress Car Park Booking Plugin version 13 October 17

Description A time-based SQL injection allows unauthenticated attackers to manipulate database queries. This is achieved by injecting SQL code through the space id parameter via GET requests sent to the 'booking-page' endpoint. Attackers can use AND SLEEP() payloads to extract sensitive database information. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to interfere with the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.