CVE ID:	CVE-2008-4094
Description:	Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Test IDs:	1.3.6.1.4.1.25623.1.0.860325   1.3.6.1.4.1.25623.1.0.860088   1.3.6.1.4.1.25623.1.0.860760   1.3.6.1.4.1.25623.1.0.860808   1.3.6.1.4.1.25623.1.0.860473   1.3.6.1.4.1.25623.1.0.860215   1.3.6.1.4.1.25623.1.0.860582   1.3.6.1.4.1.25623.1.0.860466   1.3.6.1.4.1.25623.1.0.61737   1.3.6.1.4.1.25623.1.0.860853   1.3.6.1.4.1.25623.1.0.860888   1.3.6.1.4.1.25623.1.0.61619   1.3.6.1.4.1.25623.1.0.860723   1.3.6.1.4.1.25623.1.0.860486   1.3.6.1.4.1.25623.1.0.860790   1.3.6.1.4.1.25623.1.0.61690   1.3.6.1.4.1.25623.1.0.860084
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2008-4094 BugTraq ID: 31176 http://www.securityfocus.com/bid/31176 http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter/ http://www.openwall.com/lists/oss-security/2008/09/13/2 http://www.openwall.com/lists/oss-security/2008/09/16/1 http://www.securitytracker.com/id?1020871 http://secunia.com/advisories/31875 http://secunia.com/advisories/31909 http://secunia.com/advisories/31910 SuSE Security Announcement: SUSE-SR:2008:027 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html http://www.vupen.com/english/advisories/2008/2562 XForce ISS Database: rubyonrails-activerecord-sql-injection(45109) https://exchange.xforce.ibmcloud.com/vulnerabilities/45109