Description

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-12T18:18:15.340Z",
  "pubdate": "2026-08-12T18:18:15.340Z",
  "executiveSummary": "A critical SQL injection vulnerability exists within the MySQL integration component of Budibase prior to version 3.40.0.\nThe vulnerability arises due to the component being explicitly configured with multipleStatements: true, which allows the execution of multiple discrete SQL statements within a single database query context.\nAn unauthenticated or authenticated attacker capable of supplying user-controlled input to query fields can leverage this misconfiguration to inject arbitrary malicious SQL commands.\nSuccessful exploitation of this flaw leads to complete database compromise, enabling unauthorized data exfiltration, data modification, and potential administrative takeover of the underlying database infrastructure.\nThe risk implication is severe, as it directly impacts the confidentiality, integrity, and availability of data managed by affectedBudibase instances.\nExploitation requires the ability to interact with vulnerable user input fields exposed by the MySQL integration component.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure configuration of the MySQL database driver or query execution logic within the MySQL integration component in Budibase prior to version 3.40.0.\nSpecifically, the database connection is initialized or queried with the multipleStatements parameter set to true.\nThis setting instructs the underlying database driver to process semicolon-separated SQL strings submitted in a single query execution request.\nWhen user input fields are concatenated or improperly parameterized before being passed to the database query handler, an attacker can inject a semicolon followed by arbitrary SQL commands.\nThe attack flow proceeds as follows: First, the attacker identifies a Budibase application utilizing the vulnerable MySQL integration component where user input is mapped to database queries.\nSecond, the attacker crafts a malicious payload containing the termination of the intended query using a semicolon, followed by secondary SQL commands such as stacked queries for data extraction, insertion, or destruction.\nThird, the attacker submits this input via the user-facing input fields exposed by the application.\nFourth, the Budibase backend passes the unsanitized input to the database driver.\nFifth, because multipleStatements: true is enabled, the database executes both the original application query and the attacker's injected statements sequentially within the same execution context.\nThe affected component is the MySQL integration component of Budibase across versions prior to 3.40.0.\nPost-exploitation impact includes full database compromise, unauthorized reading of sensitive tables, execution of administrative commands, and potential pivoting to underlying host infrastructure depending on database privileges."
}