Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-RUBY-ACTIVERECORDJDBCADAPTER-20076
- published 24 Feb 2013
- disclosed 24 Feb 2013
- credit Unknown
Introduced: 24 Feb 2013CVE NOT AVAILABLE CWE-89 Open this link in a new tab
ActiveRecord-JDBC-Adapter (AR-JDBC) is a database adapter for Rails' ActiveRecord component designed to be used with JRuby built upon Java's JDBC API for database access.
Affected versions of this gem are vulnerable to SQL injection attacks. The
sql.gsub() function in
lib/arjdbc/jdbc/adapter.rb is not properly sanitizing user-supplied input before using it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.