CVE-2020-5257: SQL Injection

March 13, 2020 (updated March 18, 2020)

In Administrate (rubygem), when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the direction parameter and bypass ActiveRecord SQL protections. Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication.

References

nvd.nist.gov/vuln/detail/CVE-2020-5257

Code Behaviors & Features

Detect and mitigate CVE-2020-5257 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →