CVE-2012-2695

CVE-2012-2695 describes a SQL injection vulnerability in the Active Record component of Ruby on Rails versions before 3.0.14, 3.1.6, and 3.2.6. This flaw allows remote attackers to execute SQL injection attacks by manipulating nested query parameters due to improper handling of nested hashes when passing request data to a 'where' method. With a CVSS score of 7.5, this vulnerability is considered highly severe, indicating a network-based attack with low complexity and potential for partial compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.