Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

SQL Injection Risk in Ruby on Rails

CVE-2012-2695 · published 14 years ago
Summary

A weakness in Ruby on Rails allows attackers to inject malicious SQL code through incorrect handling of nested query parameters, potentially exposing sensitive data. This issue affects certain versions of Ruby on Rails. To protect your site, update to the latest version of Ruby on Rails.

What to do
  • Update david heinemeier hansson activerecord to version 3.1.6.
  • Update david heinemeier hansson activerecord to version 3.2.6.
  • Update david heinemeier hansson activerecord to version 3.0.14.
  • Update david heinemeier hansson activerecord to version 2.3.15.
Affected software
Ecosystem VendorProductAffected versions
rubygems david heinemeier hansson activerecord >= 3.1.0, < 3.1.6
>= 3.2.0, < 3.2.6
>= 3.0.0.beta, < 3.0.14
< 2.3.15
Fix: upgrade to 3.1.6
– rubyonrails rails 3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
14 more version ranges
cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*
– rubyonrails ruby_on_rails <= 3.0.13
3.0.4
cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*
Original advisory text
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord c...
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
References
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published22 Jun 2012
Updated22 Oct 2026
First seen6 Mar 2026
Sources
GHSA-76wq-xw4h-f8wj · GHSA
CVE-2012-2695 · NVD
Track software like this
Free during beta