Active Record contains SQL Injection
High severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Nov 6, 2023
Package
Affected versions
< 3.0.18
>= 3.1.0, < 3.1.9
>= 3.2.0, < 3.2.10
Patched versions
3.0.18
3.1.9
3.2.10
Description
Published by the National Vulnerability Database
Jan 4, 2013
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Nov 6, 2023
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
References