The H reports on a newly-discovered SQL injection vulnerability in Ruby on Rails, affecting the 3.0.x, 3.1.x, and 3.2.x versions. “The vulnerability exists in versions 3.0 and later of Active Record, Rail’s database layer, and is exposed when using nested query parameters. Code that directly passes parameters to a where method, is affected. For example…
Read more at LWN
