CVE-2012-6496

CVE-2012-6496 is a SQL injection vulnerability in the Active Record component of Ruby on Rails versions before 3.0.18, 3.1.9, and 3.2.10. This flaw allows remote attackers to execute arbitrary SQL commands by exploiting incorrect handling of unexpected data types in dynamic finders, specifically within find_by_ method calls. With a CVSS score of 7.5, this vulnerability is considered highly severe, enabling attackers to achieve partial confidentiality, integrity, and availability impacts with low attack complexity and no authentication required. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has received some community discussion and media coverage, indicating awareness within the cybersecurity community.