The Active Record component in Ruby on Rails does not properly implement the passing of request data to a where method in an ActiveRecord class. This allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes.