Exploit for Improper Input Validation in Rubyonrails Rails

githubexploit · 2013-01-12

Description

Cannot assist with exploit development. Please provide a valid input payload in the expected format.

Affected software

Rubyonrails Rails< 3.2.11

Rubyonrails Ruby On Rails< 2.3.15, 3.0.19, 3.1.10

All known vulnerabilities by product

Ruby On Rails Suse

CVSS 7.5 for CVE-2013-0156

7.5

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Working code

99%confidence this exploit runs

Based on 30 file(s) in the source

EPSS Score

99.4%higher than 99.9% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2019-03-16 21:48

Last Seen:2025-08-31 23:58

Reporter:bsodmike

Written in:Ruby

Last commit:2013-01-13

Tags

requestformat

Other exploits for CVE-2013-0156

rails-exploit-cve-2013-0156

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

kuang_grade_mk11

2026-08-28 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

2026-08-25 KitPloitKITPLOIT

heroku-CVE-2013-0156

2026-08-25 KitPloitKITPLOIT

Exploit for Improper Input Validation in Rubyonrails Rails

2025-08-28 kaungsithu19GITHUB

Ruby On Rails JSON Processor YAML Deserialization Scanner

2024-09-01 H D Moore, jjarmoc, metasploit.comPACKETSTORMRuby

Exploit Code

README2 lines

## https://sploitus.com/exploit?id=996400F7-096B-512F-9FB5-55DCA79A3164
PoC exploit for CVE-2013-0156, a remote code execution vulnerability in Ruby on Rails. The target product/service is Ruby on Rails, specifically version 3.2.10, and the vulnerability class/vector is remote code execution. The probable entry point is the application.js file, which is a JavaScript file that includes the //= require_tree . directive, allowing arbitrary JavaScript code to be executed. Not specified how it is typically invoked. The expected impact is remote code execution.