EUVD-2022-5249

Malicious code in bioql PyPI...

CVE-2012-6497: Improper Neutralization of Special Elements used in an SQL Command

The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe findbyid method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secrettoken value, as...

Ruby on Rails Authlogic Gem secret_token.rb Known secret_token Value Weakness

Ruby on Rails contains a flaw in the Authlogic gem. The issue is triggered when the program makes an unsafe method call for findbyid. With a specially crafted parameter in an environment that knows the secrettoken value in secrettoken.rb, a remote attacker to more easily conduct SQL injection...