Homepage
About Snyk

SQL Injection Affecting activerecord-jdbc-adapter package, versions < 1.2.8, >= 1.2.6

0.0
medium

Snyk CVSS

    Attack Complexity High
    Confidentiality High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-ACTIVERECORDJDBCADAPTER-20076
  • published 24 Feb 2013
  • disclosed 24 Feb 2013
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 24 Feb 2013

CVE NOT AVAILABLE CWE-89 Open this link in a new tab

Overview

ActiveRecord-JDBC-Adapter (AR-JDBC) is a database adapter for Rails' ActiveRecord component designed to be used with JRuby built upon Java's JDBC API for database access. Affected versions of this gem are vulnerable to SQL injection attacks. The sql.gsub() function in lib/arjdbc/jdbc/adapter.rb is not properly sanitizing user-supplied input before using it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.