Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2020-7981: Geocoder Ruby library may execute unwanted database commands
CVE-2020-7981 · published 6 years ago
Summary
The Geocoder gem (versions before 1.6.1) can be tricked into running database queries when a map bounding box is supplied with malicious latitude or longitude values. An attacker could read or modify data in your database. Upgrade to version 1.6.1 or later and ensure any location inputs are properly validated.
What to do
- Update alex reisner geocoder to version 1.6.1.
- Update debian ruby-geocoder to version 1.5.1-3.
- Update rubygeocoder geocoder to version 1.6.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | alex reisner | geocoder |
< 1.6.1 Fix: upgrade to 1.6.1
|
| Debian:12 | debian | ruby-geocoder |
< 1.5.1-3 Fix: upgrade to 1.5.1-3
|
| – | rubygeocoder | geocoder |
< 1.6.1 cpe:2.3:a:rubygeocoder:geocoder:*:*:*:*:*:*:*:* |
Original advisory text
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7981
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7981
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/geocoder/CVE-2020-7...
- https://github.com/alexreisner/geocoder/blob/master/CHANGELOG.md#161-2020-jan-23
- https://github.com/advisories/GHSA-864j-6qpp-cmrr
- https://security-tracker.debian.org/tracker/CVE-2020-7981 Vendor Advisory
- https://github.com/alexreisner/geocoder/commit/dcdc3d8675411edce3965941a2ca7c441... Patch Third Party Advisory
- https://github.com/alexreisner/geocoder/compare/v1.6.0...v1.6.1 Release Notes Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published25 Jan 2020
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta