Homepage
About Snyk

SQL Injection Affecting activerecord-oracle_enhanced-adapter package, versions < 1.1.8

0.0
medium

Snyk CVSS

    Attack Complexity High
    Confidentiality High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-ACTIVERECORDORACLEENHANCEDADAPTER-20006
  • published 9 Oct 2008
  • disclosed 9 Oct 2008
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 9 Oct 2008

CVE NOT AVAILABLE CWE-89 Open this link in a new tab

Overview

Oracle "enhanced" ActiveRecord adapter contains useful additional methods for working with new and legacy Oracle databases. Affected versions of this gem are vulnerable SQL injection attacks. The issue is due to the program not properly sanitizing user-supplied input related to the :limit and :offset functions. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.