News for hackers. Stuff that matters.

A comment on SQL Injection Vulnerability in Ruby on Rails; affects all versions. Parent comment

Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by tenderlove on Wednesday January 02, 2013 @08:38PM (#5000592)
You need a way to inject symbols as hash keys. Normal parameter handling does not allow this, so you need a different way to exploit the bug. As venus says, session forging is one way. Regular parameter handling is not.
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by chrismsnz on Wednesday January 02, 2013 @08:40PM (#5000601)
I will defer to the rails core dev here :)

The linked vuln report gives the impression that regular parameter handling is vulnerable.

[ Parent | on HN ]