Description

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-13T22:17:24.593Z",
  "pubdate": "2026-08-13T22:17:24.593Z",
  "executiveSummary": "A SQL injection vulnerability exists in Budibase before version 3.40.0 within the Oracle datasource connector's post-write row lookup functionality.\nThe flaw stems from the failure to properly escape table names used as identifiers during database operations.\nAn attacker possessing write permissions on a targeted table that contains a double-quote character within its name can leverage this deficiency to inject arbitrary SQL statements.\nThe injected commands execute with the security context and privileges of the configured database user associated with the Oracle datasource.\nSuccessful exploitation allows unauthorized threat actors to bypass application logic, enabling both read and modification access to arbitrary data stored within the underlying database.\nThis vulnerability presents significant risk to data confidentiality and integrity, particularly in enterprise environments where database credentials may share elevated privileges.\nExploitation requires authenticated access with specific write permissions on a table possessing a maliciously crafted name featuring double-quote characters.",
  "technicalDetails": "The root cause of the vulnerability resides in the Oracle datasource connector component of Budibase, specifically within the post-write row lookup routine.\nDuring database interaction operations following a write action, the application constructs SQL queries using table identifiers derived from user-controllable schema metadata.\nThe vulnerable component fails to sanitize or properly escape table names, allowing specially crafted inputs containing SQL syntax characters—specifically double-quotes—to break out of the intended identifier context.\nThe affected product is Budibase in versions prior to 3.40.0.\nExploitation requires the attacker to have explicit write permissions on a database table.\nThe attack vector involves creating or renaming a table to include a double-quote character combined with malicious SQL syntax.\nStep-by-step, the attack flow proceeds as follows: First, the authenticated user with write capabilities establishes a table containing a double-quote in its identifier. Second, the user initiates a write operation against this table via the Budibase interface. Third, the Oracle datasource connector triggers the post-write row lookup routine, interpolating the unsanitized table name directly into the SQL statement string. Fourth, the injected SQL payload terminates the identifier string prematurely and appends arbitrary SQL commands. Finally, the database executes the resulting compounded query with the privileges of the connected database user.\nThe resulting payload behavior enables the execution of arbitrary SQL commands, facilitating unauthorized data exfiltration, data tampering, or database compromise depending on the database user's privileges.\nPost-exploitation impact includes full compromise of the data accessible by the Oracle datasource user, potentially leading to unauthorized data read, update, or delete operations across the database instance."
}