Homepage
About Snyk

SQL Injection Affecting activerecord-oracle_enhanced-adapter package, versions < 1.1.8

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-ACTIVERECORDORACLEENHANCEDADAPTER-20006
  • published 9 Oct 2008
  • disclosed 9 Oct 2008
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 9 Oct 2008

CVE NOT AVAILABLE CWE-89 Open this link in a new tab

Overview

Oracle "enhanced" ActiveRecord adapter contains useful additional methods for working with new and legacy Oracle databases. Affected versions of this gem are vulnerable SQL injection attacks. The issue is due to the program not properly sanitizing user-supplied input related to the :limit and :offset functions. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
6.5 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    Low
  • Availability (A)
    None