Based on this report, this is my rough understanding of this vulnerability: When you pass nested query parameters such as "id[a]=b&id[c]=d", Rails will parse i

Based on this report, this is my rough understanding of this vulnerability: When you pass nested query parameters such as "id[a]=b&id[c]=d", Rails will parse it as parameters :id => {'a' => 'b', 'c' => 'd'} If you use where(:id => params[:id]) it will become where(:id => {'a' => 'b', 'c' => 'd'}) And when Rails convert that to SQL statement, something can be exploited (though it's not mentioned in the report).