FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

rubygem-rails -- SQL injection vulnerability

Affected packages
rubygem-rails < 2.2.2

Details

VuXML ID 8e8b8b94-7f1d-11dd-a66a-0019666436c2
Discovery 2008-09-08
Entry 2008-09-10
Modified 2010-05-12

Jonathan Weiss reports, that it is possible to perform an SQL injection in Rails applications via not correctly sanitized :limit and :offset parameters. It is possible to change arbitrary values in affected tables or gain access to the sensitive data.

References

CVE Name CVE-2008-4094
URL http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1