CVE-2008-4094: Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters,…

Unscored severity · published Sep 30, 2008

CVE-2008-4094

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters,…

–

CVSS

EPSS

On KEV

Description

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

Exploitation

Is it being used?

Exploit prediction (EPSS)3.0% · higher than 87% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Rails · Rubyonrails

0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.4.1; 0.10.0; +34 more · source: NVD

Ruby ON Rails · Rubyonrails

through 2.1.0; 0.5.0; 0.5.5; 0.5.6; 0.5.7; 0.6.0; +5 more · source: NVD