Wheels SQL Injection Vulnerability on MySQL/MariaDB

Wheels through 4.1.2 is vulnerable to SQL injection on MySQL/MariaDB when backslash escaping is enabled (NO_BACKSLASH_ESCAPES absent) and an application supplies request data to inline-literal paths.

Affected paths include opt-in parameterize=false queries and IN lists, as well as positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments, and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query.

• Bound paths are not affected; whereBetween() is bound from 4.1.2.
• Fixed in 4.2.0.