Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 00:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 - Exploit | |
| References | () http://gist.github.com/8946 - | |
| References | () http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html - | |
| References | () http://rails.lighthouseapp.com/projects/8994/tickets/288 - Patch | |
| References | () http://rails.lighthouseapp.com/projects/8994/tickets/964 - Patch | |
| References | () http://secunia.com/advisories/31875 - Exploit, Vendor Advisory | |
| References | () http://secunia.com/advisories/31909 - Exploit, Vendor Advisory | |
| References | () http://secunia.com/advisories/31910 - Exploit, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2008/09/13/2 - | |
| References | () http://www.openwall.com/lists/oss-security/2008/09/16/1 - | |
| References | () http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter/ - Exploit | |
| References | () http://www.securityfocus.com/bid/31176 - | |
| References | () http://www.securitytracker.com/id?1020871 - | |
| References | () http://www.vupen.com/english/advisories/2008/2562 - Vendor Advisory | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/45109 - |
Information
Published : 2008-09-30 17:22
Updated : 2024-11-21 00:50
NVD link : CVE-2008-4094
Mitre link : CVE-2008-4094
CVE.ORG link : CVE-2008-4094
JSON object : View
Products Affected
rubyonrails
- rails
- ruby_on_rails
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')