Test ID:	1.3.6.1.4.1.25623.1.0.807378
Category:	Web application abuses
Title:	Ruby on Rails Active Record SQL Injection Vulnerability - Linux
Summary:	Ruby on Rails is prone to an SQL injection (SQLi) vulnerability.
Description:	Summary: Ruby on Rails is prone to an SQL injection (SQLi) vulnerability. Vulnerability Insight: The flaw is due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with 'IS NULL' or empty where clauses. Vulnerability Impact: Successful exploitation will allow a remote attacker to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain '[nil]' values. Affected Software/OS: Ruby on Rails 4.2.x before 4.2.7.1 on Linux Solution: Upgrade to Ruby on Rails 4.2.7.1 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6317 BugTraq ID: 92434 http://www.securityfocus.com/bid/92434 http://www.openwall.com/lists/oss-security/2016/08/11/4 https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA RedHat Security Advisories: RHSA-2016:1855 http://rhn.redhat.com/errata/RHSA-2016-1855.html
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.