CVE-2017-20243 - CVE House

Back to Database

Status published High CVE-2017-20243

WordPress Car Park Booking Plugin SQL Injection via space_id

8.8 CVSS

Vulnerability Description

WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-20243

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

8bitsec

References

More from QuanticaLabs

View All →

WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

WordPress Cost Calculator Plugin <= 7.4 - Cross Site Scripting (XSS) Vulnerability

WordPress GymBase Theme Classes plugin <= 1.4 - SQL Injection Vulnerability

WordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection Vulnerability

WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

Affected Vendor

QuanticaLabs

View all reports →

Affected Software

Car Park Booking System

Vulnerable Versions:

1.0

Timeline

Official Publish: June 9th, 2026

Last Modified: June 9th, 2026

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1213.006 Databases

T1485 Data Destruction