Описание
Rails ActiveRecord gem vulnerable to SQL injection
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2008-4094
- https://github.com/rails/rails/commit/ef0ea782b1f5cf7b08e74ea3002a16c708f66645
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45109
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2008-4094.yml
- https://web.archive.org/web/20080620000955/http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1
- https://web.archive.org/web/20080620201733/http://blog.innerewut.de/files/rails/activerecord-1.15.3.patch
- https://web.archive.org/web/20080620201744/http://blog.innerewut.de/files/rails/activerecord-2.0.2.patch
- https://web.archive.org/web/20081104151751/http://gist.github.com/8946
- https://web.archive.org/web/20081113122736/http://secunia.com/advisories/31875
- https://web.archive.org/web/20081207211431/http://secunia.com/advisories/31909
- https://web.archive.org/web/20081207211436/http://secunia.com/advisories/31910
- https://web.archive.org/web/20091101000000*/http://www.vupen.com/english/advisories/2008/2562
- https://web.archive.org/web/20120120194518/http://www.securityfocus.com/bid/31176
- https://web.archive.org/web/20201207112829/http://www.securitytracker.com/id?1020871
- http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
- http://rails.lighthouseapp.com/projects/8994/tickets/288
- http://rails.lighthouseapp.com/projects/8994/tickets/964
- http://www.openwall.com/lists/oss-security/2008/09/13/2
- http://www.openwall.com/lists/oss-security/2008/09/16/1
- http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter
Пакеты
activerecord
< 2.1.1
2.1.1
Связанные уязвимости
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 a ...