SQL Injection Vulnerability in Ruby on Rails by Ruby on Rails
CVE-2017-17917
8.1HIGH
Key Information:
- Vendor
Rubyonrails
- Status
- Vendor
- CVE Published:
- 29 December 2017
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2017-17917?
An SQL injection vulnerability exists in the 'where' method of Ruby on Rails versions 5.1.4 and earlier, which allows remote attackers to exploit the 'id' parameter. By manipulating this parameter, attackers can potentially execute arbitrary SQL commands in the database, risking data integrity and confidentiality. It's crucial to understand the implications of using untrusted input, as the vendor notes that the method is not designed for such use. Developers are advised to implement proper input validation and sanitization to mitigate these risks.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.