SB2012062223 - SQL injection in Ruby on Rails

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012062223

SB2012062223 - SQL injection in Ruby on Rails

Published: June 22, 2012 Updated: September 29, 2025

Security Bulletin ID SB2012062223
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) SQL injection (CVE-ID: CVE-2012-2661)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to Active Record component in Ruby on Rails does not properly implement the passing of request data to a where method in an ActiveRecord class. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database to read data.


Remediation

Install update from vendor's website.

References