SQL Injection

activerecord is vulnerable to SQL Injection. The vulnerability exists because the value parameter is not properly sanitised in the sanitizeassqlcomment function of quoting.rb, allowing an attacker to inject and execute a malicious query string...