CVE-2020-7981 SQL Injection in Geocoder
Attackers can execute SQL injection via untrusted coordinates in the Geocoder Ruby library, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7981?
CVE-2020-7981 is a critical SQL injection vulnerability in n/a, published on 25 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
Weakness: CWE-89
Which versions are affected by CVE-2020-7981?
2 open source packages ship an affected version, including geocoder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
geocoder RubyGems | All versions | 1.6.1 |
geocoder RubyGems | All versions | 1.6.1 |
Products include Rubygeocoder Geocoder.
How do I fix CVE-2020-7981?
Upgrade geocoder to 1.6.1 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-7981 being exploited?
There is no known exploitation of CVE-2020-7981 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-7981, GHSA-864j-6qpp-cmrr.