Here's the relevant section of the Rails manual describing this exploit, along with some ways to prevent it.

http://guides.rubyonrails.org/security.html#mass-assignment