#Anonymous #Cyberwar CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection v... #Antisec #Operation

CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection vulnerability | Hacking News | Security updates

#Anonymous #Cyberwar CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection v... #Antisec #Operation

A SQL Injection vulnerability has been discovered in Ruby on Rails that affects all current versions of the web framework. According to the advisory , due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. A Hacker can manipulate it carefully and thereby inject arbitrary SQL code leading to an SQL injection. Dynamic finders use the method name to determine what field to search, so calls such as: Post.find_by_id(params[:id]) would be vulnerable to an attack. The vulnerability has been fixed in the latest released version 3.2.10, 3.1.9, 3.0.18. All users running an affected release should either upgrade or use one of the work arounds immediately. The Vulnerability was disclosed on the the Phenoelit blog in late December where author used the technique to extract user credentials bypassing ...

Full article: http://www.ehackingnews.com/2013/01/sqli-in-ruby-on-rails...

Tweets

@fakessh » 04 Jan '13, 8pm
Hacker News: CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection vulnerability [link] via @sharethis
@Pain_Thanatos » 04 Jan '13, 8pm
CVE-2012-5664 :All Ruby on Rails versions #vulnerable to #SQLInjectionVuln [link] via @sharethis #EHN #Security #SQL #SQLInjct
@Netw0rkSecurity » 04 Jan '13, 7pm
#OWASP CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL - A SQL Injection vulnerability has been dis ... [link]
@AnOn_GyNiUs » 04 Jan '13, 8am
CVE-2012-5664 :All Ruby on Rails versions #vulnerable to #SQL #Injection vulnerability: A SQL Injection vulnerabili... [link]
@Jessica101214 » 04 Jan '13, 3am
CVE-2012-5664 :All Ruby on Rails versions vulnerable to #SQL Injection vulnerability | #Hacking News | Security updates [link]
@fainomenous » 04 Jan '13, 2am
CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection vulnerability ~ eHackingNews: [link]
@netsecured99 » 04 Jan '13, 1am
RT @acotino2013CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection vulnerability [link] #vulnerabilit...
@anonnewsnc » 04 Jan '13, 1am
#Anonymous #Cyberwar CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection v... [link] #Antisec #Operat...
@fendyafriyansah » 04 Jan '13, 1am
RT @binushacker: #Anonymous #Cyberwar CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection v... [link] #Antisec #Operation
@icheernoom » 04 Jan '13, 1am
RT @EHackerNews: #EHN : SQL Injection #vulnerability in Ruby on Rails: [link] #security #infosec #news #hacking #ITsecurity
@EHackerNews » 04 Jan '13, 1am
#EHN : SQL Injection #vulnerability in Ruby on Rails: [link] #security #infosec #news #hacking #ITsecurity
@j0eylane » 04 Jan '13, 1am
CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection vulnerability [link] #hacking #infosec
@binushacker » 04 Jan '13, 1am
#Anonymous #Cyberwar CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection v... [link] #Antisec #Operation
@AnTGaming » 04 Jan '13, 1am
RT @binushacker: #Anonymous #Cyberwar CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection v... [link] #Antisec #Operation
@SanjeevGiri2 » 04 Jan '13, 1am
CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection vulnerability [link]
@AKhaeLzAnon » 04 Jan '13, 1am
#Anonymous #Cyberwar CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection v... [link] #Antisec #Operation

CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection vulnerability | Hacking News | Security updates

#Anonymous #Cyberwar CVE-2012-5664 :All Ruby on Rails versions vulnerable to SQL Injection v... #Antisec #Operation

Tweets

SQL injection vulnerability hits all Ruby on Ra...

SQL injection vulnerability hits all Ruby on Ra...

SQL Injection Vulnerability in Ruby on Rails; a...

sql injection vulnerability in Active Record in...

SQL Injection Flaw Haunts All Ruby on Rails Ver...

All Ruby on Rails versions affected by SQL inje...

All Ruby On Rails Versions Suffer SQL Injection...

Ruby on Rails security updates address SQL inje...

SQL Injection Flaw Haunts All Ruby on Rails Ver...

Ruby on Rails security updates address SQL inje...

All Ruby On Rails Versions Suffer SQL Injection...

Ruby on Rails has SQL injection vuln

Ruby on Rails security updates address SQL inje...

Ruby on Rails updates address SQL injection fla...

SQL Injection Vulnerability in several versions...