CVE-2011-0448

CVE-2011-0448 describes a SQL injection vulnerability in Ruby on Rails versions 3.0.x prior to 3.0.4. This flaw arises because the framework fails to validate that arguments passed to the 'limit' function are integers, allowing remote attackers to inject malicious SQL via non-numeric input. With a CVSS score of 7.5, this vulnerability is considered highly severe, requiring no authentication and having a low attack complexity, potentially leading to compromise of confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.