Ruby on Rails ':offset' And ':limit' Parameters SQL Injection Vulnerabilities

Bugtraq ID:	31176
Class:	Input Validation Error
CVE:	CVE-2008-4094
Remote:	Yes
Local:	No
Published:	Jun 01 2008 12:00AM
Updated:	Apr 13 2015 09:13PM
Credit:	Tobias Schlottke
Vulnerable:	SuSE SUSE Linux Enterprise Server 10 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 Ruby on Rails Ruby on Rails 2.1 Ruby on Rails Ruby on Rails 1.2.6 Ruby on Rails Ruby on Rails 1.2.5 Ruby on Rails Ruby on Rails 1.2.3 Ruby on Rails Ruby on Rails 1.1.6 Ruby on Rails Ruby on Rails 1.1.5 Ruby on Rails Ruby on Rails 1.1.4 Ruby on Rails Ruby on Rails 1.1.3 Ruby on Rails Ruby on Rails 1.1.2 Ruby on Rails Ruby on Rails 1.1.1 rPath rPath Linux 2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 2 rPath Appliance Platform Linux Service 1 Gentoo Linux
Not Vulnerable:	Ruby on Rails Ruby on Rails 2.1.1

Ruby on Rails ':offset' And ':limit' Parameters SQL Injection Vulnerabilities

Ruby on Rails is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Versions prior to Ruby on Rails 2.1.1 are affected.

Ruby on Rails ':offset' And ':limit' Parameters SQL Injection Vulnerabilities

Attackers can exploit the issues via a browser.

Ruby on Rails ':offset' And ':limit' Parameters SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Ruby on Rails ':offset' And ':limit' Parameters SQL Injection Vulnerabilities

References:

• [patch] - SQL Injection for :limit and :offset (Aaron Bedra)
  
• Rails 2.1.1: Lots of bug fixes (Ruby on Rails)
  
• Ruby on Rails Homepage (Ruby on Rails)
  
• Why you should upgrade to Rails 2.1 (Jonathan)
  
• rPSA-2008-0295-1 rails (rPath Update Announcements )