Description

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

Remediation

References

CVE-2008-4094

Related Vulnerabilities

WordPress Plugin Allow PHP in Posts and Pages 'id' Parameter SQL Injection (2.0.0.RC1)

ReviveAdserver Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-22872)

OpenSSL Resource Management Errors Vulnerability (CVE-2012-0050)

WordPress Plugin WP Reroute Email SQL Injection (1.4.6)

Undertow Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2020-10687)

Severity

High

Classification

CVE-2008-4094 CWE-138

Tags

Missing Update Known Vulnerabilities