Trilogy: SQL Injection vulnerability via multibyte encodings

A SQL injection vulnerability exists in the Trilogy library, an underlying database client used in some Ruby on Rails environments. The flaw stems from improper handling of multibyte character encodings during string escaping, which can allow an attacker to bypass protection mechanisms. Updating to version 2.13.2 or later is required to mitigate this vulnerability.

Impact

Successful exploitation could lead to unauthorized database access, data exfiltration, or modification of application data depending on the implementation of the database queries and the application environment.

Recommendation

• Upgrade the Trilogy library to version 2.13.2 or later in all projects utilizing the library as a database dependency.
• Audit database queries using user-supplied input to ensure that parameterized queries or safe ORM methods are used as a defense-in-depth measure.
• Review application logs for unusual query patterns or unexpected database errors that may indicate injection attempts.