Dashboard / CVE-2017-20243

CVE-2017-20243

HIGH
MEDIUM Priority: 0.02 BB Relevance: 78/100
Published: 2026-06-09 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: None
VC: High
VI: Low
VA: None

Description

WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
gurutechteam Car Park Booking WordPress Plugin 13 October 17
gurutechteam Car Park Booking WordPress Plugin 13 October 17

References & Advisories (3)

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.26%
Raw Score 0.002620
Percentile 18.0%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links