This is nothing new (cf. http://wiki.rubyonrails.org/rails/pages/SingleTableInheritance) but I show how to exploit it in conjunction another security hole.

There are 2 ways to call system (http://www.ruby-doc.org/core/classes/Kernel.html#M005982):

a) with a single string
system(“echo $(seq 5)”)
that’s prone to shell injection, unless the string is properly escaped (see e.g. http://www.a-k-r.org/escape/)

b) with a command-string and each argument as an additional string:
system(“echo”, “$(seq 5)”)

This is save against shell injection. (as save as the called command/shell script).

Kernel.system
Kernel.exec
%x[]
` (The back-tick operator)