CVE-2017-17917

HIGH LAB

Ruby on Rails < 5.1.4 - SQL Injection via 'where' Method 'id' Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-17917. PoCs published by matiasarenhard.

AI-analyzed exploit summary This repository demonstrates a SQL injection vulnerability (CVE-2017-17917) in a Rails application by exploiting an unsafe `where` clause in the `ClientsController`. It includes a vulnerable and patched version of the code for educational purposes.

Description

SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input

Exploits (1)

nomisec WORKING POC 1 stars
by matiasarenhard · poc
https://github.com/matiasarenhard/rails-cve-2017-17917

This repository demonstrates a SQL injection vulnerability (CVE-2017-17917) in a Rails application by exploiting an unsafe `where` clause in the `ClientsController`. It includes a vulnerable and patched version of the code for educational purposes.

Classification
Working Poc 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Ruby on Rails (versions affected by CVE-2017-17917)
No auth needed
Prerequisites: Docker and Docker-Compose for environment setup · Access to the vulnerable endpoint with the `id_search` parameter
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0228
EPSS Percentile 81.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Lab Environment

COMMUNITY
Community Lab

Details

CWE
CWE-89
Status published
Products (1)
rubyonrails/rails < 5.1.4
Published Dec 29, 2017
Tracked Since Feb 18, 2026