A new SQL-injection vulnerability for the new year, this time in an otherwise common and innocuous-looking part of Ruby on Rails’ ActiveRecord:
Post.find_by_id(params[:id])
It is disappointing that the default ORM in Rails cannot yet safely query by identifier, a task made trivial by pre-compiled DBI queries using placeholders, or in this case, a single placeholder!
Check the original post for workaround.
4 Responses to New Rails SQL Injection Vulnerability Uncovered