NetSight
IP …
high7.5

CVE-2008-4094

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offse…

Impact

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

Affected products

VendorProductAffected versions
RubyonrailsRails
Versions 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.4.1, 0.10.0
RubyonrailsRuby On Rails
through 2.1.0
Versions 0.5.0, 0.5.5, 0.5.6, 0.5.7, 0.6.0

Weakness classification

CWE-89

References