Executive brief
The Car Park Booking plugin for WordPress, which manages parking reservations, contains a security flaw that allows unauthorized individuals to access the website's database. By sending specially crafted web requests, an attacker can bypass security controls to steal sensitive information such as customer data or site configuration details. This could lead to a significant data breach or compromise of the website's integrity.
Technical details
A time-based blind SQL injection vulnerability exists in the 'space_id' parameter of the 'booking-page' endpoint in the WordPress Car Park Booking Plugin. The flaw stems from improper neutralization of special elements used in SQL commands (CWE-89). An unauthenticated remote attacker can exploit this by sending GET requests containing malicious SQL payloads, such as 'AND SLEEP()', to observe server response delays. Successful exploitation allows the attacker to exfiltrate sensitive data from the underlying MySQL database. The vulnerability was verified in the version released on October 17, 2017, and affects versions up to 1.0.
Affected products
- WordPress Car Park Booking System <= 1.0 (version 13 October 17)
Timeline
- 2017-10-17: disclosed: Initial exploit published on Exploit-DB
- 2026-06-09: advisory: CVE-2017-20243 published to NVD