SQL Injection

curupira is vulnerable to SQL Injection. A specifically crafted attack statement through the create function in passwords_controller.rb allows a malicious user to inject and execute arbitrary SQL queries on the target system.