Ruby on Rails CVE-2012-2694 Unsafe SQL Query Generation Vulnerability
BID:53976
Info
Ruby on Rails CVE-2012-2694 Unsafe SQL Query Generation Vulnerability
| Bugtraq ID: | 53976 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-2694 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 12 2012 12:00AM |
| Updated: | Apr 16 2015 05:46PM |
| Credit: | Egor Homakov, Paul Lynch |
| Vulnerable: |
SuSE WebYaST 1.2 SuSE SUSE Linux Enterprise SDK 11 SP2 SuSE SUSE Linux Enterprise SDK 11 SP1 SuSE Studio Standard Edition 1.2 SuSE Studio Onsite 1.2 SuSE Studio Extension for System z 1.2 SuSE openSUSE 12.1 SuSE openSUSE 11.4 Ruby on Rails Ruby on Rails 3.2.4 Ruby on Rails Ruby on Rails 3.2.2 Ruby on Rails Ruby on Rails 3.1.5 Ruby on Rails Ruby on Rails 3.1.4 Ruby on Rails Ruby on Rails 3.1.2 Ruby on Rails Ruby on Rails 3.0.13 Ruby on Rails Ruby on Rails 3.0.12 Ruby on Rails Ruby on Rails 3.0.11 Ruby on Rails Ruby on Rails 3.0.6 Ruby on Rails Ruby on Rails 3.0.5 Ruby on Rails Ruby on Rails 3.0.4 Ruby on Rails Ruby on Rails 3.0.3 Ruby on Rails Ruby on Rails 3.0.2 Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 3.0 Ruby on Rails Ruby on Rails 3.1.0.rc6 Ruby on Rails Ruby on Rails 3.1.0.rc5 Ruby on Rails Ruby on Rails 3.0.8 Ruby on Rails Ruby on Rails 3.0.7 Ruby on Rails Ruby on Rails 3.0.10 |
| Not Vulnerable: | |
Discussion
Ruby on Rails CVE-2012-2694 Unsafe SQL Query Generation Vulnerability
Ruby on Rails is prone to an unsafe SQL query generation vulnerability
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The vulnerability is fixed in the following versions:
Ruby on Rails 3.2.6, 3.1.6, and 3.0.14
Ruby on Rails is prone to an unsafe SQL query generation vulnerability
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The vulnerability is fixed in the following versions:
Ruby on Rails 3.2.6, 3.1.6, and 3.0.14
Exploit / POC
Ruby on Rails CVE-2012-2694 Unsafe SQL Query Generation Vulnerability
An attacker can use a browser to exploit this issue.
An attacker can use a browser to exploit this issue.
Solution / Fix
Ruby on Rails CVE-2012-2694 Unsafe SQL Query Generation Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Ruby on Rails CVE-2012-2694 Unsafe SQL Query Generation Vulnerability
References:
References:
- Ruby on Rails Homepage (Ruby on Rails)