CVE-2008-7309

Published: Apr 5, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a "mass assignment" vulnerability.

Affected (1)

Products: Insoshi: Insoshi

Insoshi

1 product

Insoshi

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Insoshi Insoshi	version ≤ 20080919

Related CWEs

CWE-255

References (4)

http://blog.mhartl.com/2008/09/21/finding-and-fixing-mass-assignment-problems-in-rails-applications/

Source: cve@mitre.org

Exploit

http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment

Source: cve@mitre.org

Exploit

http://blog.mhartl.com/2008/09/21/finding-and-fixing-mass-assignment-problems-in-rails-applications/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.