6 ms·
Some details on how this can be exploited: http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection http://www.zweitag.de/en
by Tho85 14y ago
Some details on how this can be exploited:
http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-ma...
- tenderlove 14y agoThanks for reporting this issue to us! :-D <3<3<3<3
- Tho85 14y agoWas a pleasure! With love :-) Thomas
- deleted 14y ago[deleted]
- benmmurphy 14y agonice find. there is sql injection in 2.3.x and it effects all adapters and not just postgresql. i just tried quoted_id and it works against mysql on 3.2.x as well. quoted_id is defined in abstract/quoting.rb and any adapter that forwards quotes to the superclass will use it.
- Tho85 14y agoYou're right! Thanks for the hint, I updated the blog post accordingly.