CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.
Explanation of Vulnerability in Simple Terms
The Car Park Booking System contains a SQL injection vulnerability in its input handling. An attacker on the network can craft malicious input to execute arbitrary SQL commands against the database without authentication. This allows reading or modifying booking records and other sensitive data stored in the system.
What an attacker can do
Execute SQL commands to read or modify database records without authentication.
Potential impact on your site
Attackers can access, modify, or delete booking data and other database contents without logging in.
Conditions required to exploit
Network access to the Car Park Booking System; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
