CVE-2017-17919

The CVE-2017-17919 entry describes a SQL injection in Rails 5.1.4 and earlier, exploitable via the id desc parameter in the order method. Concrete details across connected docs: affected software (Ruby on Rails), vulnerable component (order method handling untrusted input), and the underlying iss...

CVE-2017-17920

CVE-2017-17920 affects Ruby on Rails 5.1.4 and earlier, via the reorder method where the name parameter can be used to inject SQL. The root cause is SQL injection in that method, enabling arbitrary SQL execution. Multiple connected sources confirm the vulnerability and the vendor disputes the iss...