A new SQL-injection vulnerability for the new year, this time in an otherwise common and innocuous-looking part of Ruby on Rails’ ActiveRecord:
Post.find_by_id(params[:id])
It is disappointing that the default ORM in Rails cannot yet safely query by identifier, a task made trivial by pre-compiled DBI queries using placeholders, or in this case, a single placeholder!
Check the original post for workaround.
The likelihood of code exploit on a device as specialized as the PIN/signature pads is small relative to the networked general purpose point of sale systems they interface with. Look for more info to emerge on this one:
http://nj1015.com/barnes-and-noble-pin-pads-hacked-in-nine-states/
For now, B&N retail customers should watch their statements.
