CVE-2012-2661
Active Record vulnerable to SQL Injection via nested query parameters
5.0 MediumPublic exploitFix available
CVE-2012-2661 is a medium vulnerability (CVSS 5.0) in Rubyonrails Rails, published June 22, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.04%, the 90th percentile. Fixed in activerecord 3.0.13.
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
Exploit likelihood
4.04%Up 2.8 points since Feb 4, 2022
What each source reports
NVD Score used
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
- Record
CVE-2012-2661- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
- Record
CVE-2012-2661- Updated
- 2026-11-02
EUVDEUVD-2017-0229 No score
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
- Record
EUVD-2017-0229- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fh39-v733-mxfr No score
Active Record vulnerable to SQL Injection via nested query parameters
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
- Record
GHSA-fh39-v733-mxfr- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-fh39-v733-mxfr No score
Active Record vulnerable to SQL Injection via nested query parameters
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
- Record
GHSA-fh39-v733-mxfr- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
3.0.0 up to 3.0.13 | 3.0.13 |
activerecordRubyGems |
3.1.0 up to 3.1.5 | 3.1.5 |
activerecordRubyGems |
3.2.0 up to 3.2.4 | 3.2.4 |
activerecordRubyGems |
3.0.0 up to 3.0.13, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 23 moreShow less3.0.12.rc13.0.13.rc13.0.23.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc5 |
3.0.13 |
activerecordRubyGems |
3.1.0 up to 3.1.5, plus listed versions 3.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.2 Show 6 moreShow less3.1.2.rc13.1.2.rc23.1.33.1.43.1.4.rc13.1.5.rc1 |
3.1.5 |
activerecordRubyGems |
3.2.0 up to 3.2.4, plus listed versions 3.2.13.2.23.2.2.rc13.2.33.2.3.rc13.2.3.rc23.2.4.rc1 |
3.2.4 |
graphvizRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-debuginfoRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-develRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-docRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
Show 65 moreShow less
| Package | Affected | Fixed |
|---|---|---|
graphviz-gdRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-rubyRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
openshift-consoleRed Hat:openshift:1::el6 |
before 0:0.0.16-1.el6op | 0:0.0.16-1.el6op |
openshift-origin-brokerRed Hat:openshift:1::el6 |
before 0:1.0.11-1.el6op | 0:1.0.11-1.el6op |
openshift-origin-broker-utilRed Hat:openshift:1::el6 |
before 0:1.0.15-1.el6op | 0:1.0.15-1.el6op |
ruby193-rubyRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-debuginfoRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-develRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-docRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-irbRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-libsRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-tcltkRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-rubygem-actionpackRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
ruby193-rubygem-actionpack-docRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
ruby193-rubygem-activemodelRed Hat:openshift:1::el6 |
before 0:3.2.8-2.el6 | 0:3.2.8-2.el6 |
ruby193-rubygem-activemodel-docRed Hat:openshift:1::el6 |
before 0:3.2.8-2.el6 | 0:3.2.8-2.el6 |
ruby193-rubygem-activerecordRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
ruby193-rubygem-activerecord-docRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
ruby193-rubygem-bigdecimalRed Hat:openshift:1::el6 |
before 0:1.1.0-25.el6 | 0:1.1.0-25.el6 |
ruby193-rubygem-io-consoleRed Hat:openshift:1::el6 |
before 0:0.3-25.el6 | 0:0.3-25.el6 |
ruby193-rubygem-jsonRed Hat:openshift:1::el6 |
before 0:1.5.4-25.el6 | 0:1.5.4-25.el6 |
ruby193-rubygem-minitestRed Hat:openshift:1::el6 |
before 0:2.5.1-25.el6 | 0:2.5.1-25.el6 |
ruby193-rubygem-railtiesRed Hat:openshift:1::el6 |
before 0:3.2.8-2.el6 | 0:3.2.8-2.el6 |
ruby193-rubygem-railties-docRed Hat:openshift:1::el6 |
before 0:3.2.8-2.el6 | 0:3.2.8-2.el6 |
ruby193-rubygem-rakeRed Hat:openshift:1::el6 |
before 0:0.9.2.2-25.el6 | 0:0.9.2.2-25.el6 |
ruby193-rubygem-rdocRed Hat:openshift:1::el6 |
before 0:3.9.4-25.el6 | 0:3.9.4-25.el6 |
ruby193-rubygem-ruby_parserRed Hat:openshift:1::el6 |
before 0:2.3.1-3.el6op | 0:2.3.1-3.el6op |
ruby193-rubygem-ruby_parser-docRed Hat:openshift:1::el6 |
before 0:2.3.1-3.el6op | 0:2.3.1-3.el6op |
ruby193-rubygemsRed Hat:openshift:1::el6 |
before 0:1.8.23-25.el6 | 0:1.8.23-25.el6 |
ruby193-rubygems-develRed Hat:openshift:1::el6 |
before 0:1.8.23-25.el6 | 0:1.8.23-25.el6 |
rubygem-actionpackRed Hat:openshift:1::el6 |
before 1:3.0.13-4.el6op | 1:3.0.13-4.el6op |
rubygem-activemodelRed Hat:openshift:1::el6 |
before 0:3.0.13-3.el6op | 0:3.0.13-3.el6op |
rubygem-activemodel-docRed Hat:openshift:1::el6 |
before 0:3.0.13-3.el6op | 0:3.0.13-3.el6op |
rubygem-activerecordRed Hat:openshift:1::el6 |
before 1:3.0.13-5.el6op | 1:3.0.13-5.el6op |
rubygem-bsonRed Hat:openshift:1::el6 |
before 0:1.8.1-2.el6op | 0:1.8.1-2.el6op |
rubygem-mongoRed Hat:openshift:1::el6 |
before 0:1.8.1-2.el6op | 0:1.8.1-2.el6op |
rubygem-mongo-docRed Hat:openshift:1::el6 |
before 0:1.8.1-2.el6op | 0:1.8.1-2.el6op |
rubygem-openshift-origin-auth-remote-userRed Hat:openshift:1::el6 |
before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
rubygem-openshift-origin-consoleRed Hat:openshift:1::el6 |
before 0:1.0.10-1.el6op | 0:1.0.10-1.el6op |
rubygem-openshift-origin-console-docRed Hat:openshift:1::el6 |
before 0:1.0.10-1.el6op | 0:1.0.10-1.el6op |
rubygem-openshift-origin-controllerRed Hat:openshift:1::el6 |
before 0:1.0.12-1.el6op | 0:1.0.12-1.el6op |
rubygem-ruby_parserRed Hat:openshift:1::el6 |
before 0:2.0.4-6.el6op | 0:2.0.4-6.el6op |
rubygem-ruby_parser-docRed Hat:openshift:1::el6 |
before 0:2.0.4-6.el6op | 0:2.0.4-6.el6op |
openshift-origin-cartridge-jbosseap-6.0Red Hat:openshift:1::el6 |
before 0:1.0.4-1.el6op | 0:1.0.4-1.el6op |
openshift-origin-cartridge-cron-1.4Red Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
openshift-origin-cartridge-diy-0.1Red Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
openshift-origin-cartridge-haproxy-1.4Red Hat:openshift:1::el6 |
before 0:1.0.4-1.el6op | 0:1.0.4-1.el6op |
openshift-origin-cartridge-jbossews-1.0Red Hat:openshift:1::el6 |
before 0:1.0.13-1.el6op | 0:1.0.13-1.el6op |
openshift-origin-cartridge-jenkins-1.4Red Hat:openshift:1::el6 |
before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
openshift-origin-cartridge-jenkins-client-1.4Red Hat:openshift:1::el6 |
before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
openshift-origin-cartridge-mysql-5.1Red Hat:openshift:1::el6 |
before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
openshift-origin-cartridge-perl-5.10Red Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
openshift-origin-cartridge-php-5.3Red Hat:openshift:1::el6 |
before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
openshift-origin-cartridge-postgresql-8.4Red Hat:openshift:1::el6 |
before 0:1.0.3-2.el6op | 0:1.0.3-2.el6op |
openshift-origin-cartridge-ruby-1.8Red Hat:openshift:1::el6 |
before 0:1.0.7-1.el6op | 0:1.0.7-1.el6op |
openshift-origin-cartridge-ruby-1.9-sclRed Hat:openshift:1::el6 |
before 0:1.0.8-1.el6op | 0:1.0.8-1.el6op |
openshift-origin-msg-node-mcollectiveRed Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
phpRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-bcmathRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-debuginfoRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-develRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-imapRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-mbstringRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-processRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
rubygem-openshift-origin-nodeRed Hat:openshift:1::el6 |
before 0:1.0.11-1.el6op | 0:1.0.11-1.el6op |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | r4x0r1337/-CVE-2012-2661-ActiveRecord-SQL-injection- | 2022-02-23 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&output=gplain
lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
rhn.redhat.com/errata/RHSA-2013-0154.html
nvd.nist.gov/vuln/detail/CVE-2012-2661
Show 76 moreShow less
github.com/advisories/GHSA-fh39-v733-mxfr
access.redhat.com/errata/RHSA-2013:0582
bugzilla.redhat.com/show_bug.cgi?id=827353
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0582.json
cve.org/CVERecord?id=CVE-2012-2660