SQL Injection Affecting update_by_case package, versions <0.1.3


0.0
high
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-RUBY-UPDATEBYCASE-2980124

  • published

    12 Aug 2022

  • disclosed

    11 Aug 2022

  • credit

    Unknown

How to fix?

Upgrade update_by_case to version 0.1.3 or higher.

Overview

update_by_case is an a package that allows you to update multiple ActiveRecord records based on case values on a single database hit

Affected versions of this package are vulnerable to SQL Injection in the UpdateByCase and Utils classes, which accept and process SQL strings without sanitization.

References