CVE-2012-2661

El componente Active Record en Ruby on Rails v3.0.x antes de v3.0.13, v3.1.x antes de v3.1.5 y v3.2.x antes de 3.2.4 no implementan correctamente el paso de los datos de la solicitud a un método 'where' en la clase ActiveRecord, lo que permite a atacantes remotos llevar a cabo determinados ataques de inyección SQL a través de parámetros de consulta anidadas que se aprovechan de una recursividad no deseada. Se trata de un problema relacionado con el CVE-2012-2695.

Ruby on Rails is a model-view-controller framework for web application development. Action Pack implements the controller and the view components. Active Record implements object-relational mapping for accessing database entries using objects. Active Support provides support and utility classes used by the Ruby on Rails framework. Multiple flaws were found in the way Ruby on Rails performed XML parameter parsing in HTTP requests. A remote attacker could use these flaws to execute arbitrary code with the privileges of a Ruby on Rails application, perform SQL injection attacks, or bypass the authentication using a specially-created HTTP request.