CVE-2008-4094: rubyonrails rails SQL Injection

CVSS: 7.5v2.0HighModified

AliasesDEBIAN-CVE-2008-4094GHSA-xf96-32q2-9rw2

Published 30-09-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-4094 is a high (CVSS 7.5) SQL Injection vulnerability in rubyonrails rails. EPSS estimates a 3.03% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

41/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

3.03%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits5reference

Timeline

30-09-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

3.03%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

0.00 pp

From 3.03% on 20-09-2026

20-09-202620-10-2026

EPSS score

3.03%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (secunia.com)
Maturity: unknown
referenceUnverified
Exploit Reference (secunia.com)
Maturity: unknown
referenceUnverified
Exploit Reference (blog.innerewut.de)
Maturity: unknown

Show all 5 exploits

referenceUnverified
Exploit Reference (rorsecurity.info)
Maturity: unknown
referenceUnverified
Exploit Reference (secunia.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Rubyonrails2 products

rails0.9.1 | 0.9.2 | 0.9.3 | 0.9.4 | 0.9.4.1 | 0.10.0 | 0.10.1 | 0.11.0 | 0.11.1 | 0.12.0 | 0.12.1 | 0.13.0 | 0.13.1 | 0.14.1 | 0.14.2 | 0.14.3 | 0.14.4 | 1.0.0 | 1.1.0 | 1.1.1 | 1.1.2 | 1.1.3 | 1.1.4 | 1.1.5 | 1.1.6 | 1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.2.6 | 1.9.5 | 2.0.0 | 2.0.0:rc1 | 2.0.0:rc2 | 2.0.1 | 2.0.2 | 2.0.4 | 2.1.0
ruby_on_rails≤ 2.1.0 | 0.5.0 | 0.5.5 | 0.5.6 | 0.5.7 | 0.6.0 | 0.6.5 | 0.7.0 | 0.8.0 | 0.8.5 | 0.9.0

Debian1 product

rails< 2.1.0-1

RubyGems1 product

activerecord< 2.1.1

3 vendors · 4 products

References

31 links

gist.github.com/8946X Refsource CONFIRM
exchange.xforce.ibmcloud.com/vulnerabilities/45109VDB EntryX Refsource XFWEB
www.openwall.com/lists/oss-security/2008/09/13/2Mailing ListX Refsource MLISTWEB
rails.lighthouseapp.com/projects/8994/tickets/964X Refsource CONFIRMPatchWEB
rails.lighthouseapp.com/projects/8994/tickets/288X Refsource CONFIRMPatchWEB
secunia.com/advisories/31875Third Party AdvisoryX Refsource SECUNIAExploitVendor Advisory
lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.htmlVendor AdvisoryX Refsource SUSEWEB
secunia.com/advisories/31910Third Party AdvisoryX Refsource SECUNIAExploitVendor Advisory
blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1X Refsource MISCExploit
www.securitytracker.com/id?1020871VDB EntryX Refsource SECTRACK

Show all 31 references

www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter/X Refsource MISCExploit
www.openwall.com/lists/oss-security/2008/09/16/1Mailing ListX Refsource MLISTWEB
www.securityfocus.com/bid/31176VDB EntryX Refsource BID
secunia.com/advisories/31909Third Party AdvisoryX Refsource SECUNIAExploitVendor Advisory
www.vupen.com/english/advisories/2008/2562VDB EntryX Refsource VUPENVendor Advisory
security-tracker.debian.org/tracker/CVE-2008-4094Advisory
nvd.nist.gov/vuln/detail/CVE-2008-4094Advisory
github.com/rails/rails/commit/ef0ea782b1f5cf7b08e74ea3002a16c708f66645WEB
github.com/rails/railsPACKAGE
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2008-4094.ymlWEB
web.archive.org/web/…WEB
web.archive.org/web/20080620201733/http://blog.innerewut.de/files/rails/activerecord-1.15.3.patchWEB
web.archive.org/web/20080620201744/http://blog.innerewut.de/files/rails/activerecord-2.0.2.patchWEB
web.archive.org/web/20081104151751/http://gist.github.com/8946WEB
web.archive.org/web/20081113122736/http://secunia.com/advisories/31875WEB
web.archive.org/web/20081207211431/http://secunia.com/advisories/31909WEB
web.archive.org/web/20081207211436/http://secunia.com/advisories/31910WEB
web.archive.org/web/20091101000000*/http://www.vupen.com/english/advisories/2008/2562WEB
web.archive.org/web/20120120194518/http://www.securityfocus.com/bid/31176WEB
web.archive.org/web/20201207112829/http://www.securitytracker.com/id?1020871WEB
www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameterWEB

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities