CVE-2012-6497

CVE-2012-6497 describes a SQL injection vulnerability in the Authlogic gem for Ruby on Rails, affecting versions prior to 3.2.10. This flaw arises from potentially unsafe find_by_id method calls, enabling remote attackers to inject malicious SQL queries if a known secret_token value is present. The vulnerability has a CVSS score of 5.0, indicating a medium severity with low attack complexity and no authentication required, potentially leading to partial confidentiality impact. There is no evidence of active exploitation, nor are there readily available exploit modules in Metasploit or Nuclei; however, it has garnered some community discussion and media coverage.