SQL Injection Affecting activerecord-jdbc-adapter package, versions >=1.2.6, <1.2.8
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-ACTIVERECORDJDBCADAPTER-1315826
- published 2 Jul 2021
- disclosed 2 Jul 2021
- credit Unknown
How to fix?
Upgrade activerecord-jdbc-adapter to version 1.2.8 or higher.
Overview
Affected versions of this package are vulnerable to SQL Injection due to the sql.gsub() function in lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input beforeusing it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
References
CVSS Scores
version 3.1