Hacker News Reader

Parent Full thread

Tho85

Some details on how this can be exploited:

http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-ma...

View on HN

Thanks for reporting this issue to us! :-D

<3<3<3<3

Was a pleasure!

With love :-) Thomas

nice find. there is sql injection in 2.3.x and it effects all adapters and not just postgresql.

i just tried quoted_id and it works against mysql on 3.2.x as well. quoted_id is defined in abstract/quoting.rb and any adapter that forwards quotes to the superclass will use it.

You're right! Thanks for the hint, I updated the blog post accordingly.

Reply on news.ycombinator.com