Description
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
Remediation
References
Related Vulnerabilities
Joomla Numeric Errors Vulnerability (CVE-2008-4102)
WordPress Plugin Podlove Podcast Publisher Cross-Site Request Forgery (3.8.3)
WordPress 4.6.x Multiple Vulnerabilities (4.6 - 4.6.27)
MySQL CVE-2017-10227 Vulnerability (CVE-2017-10227)
WordPress Plugin YITH WooCommerce Bulk Product Editing Security Bypass (1.2.13)