Description

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-13T22:17:25.810Z",
  "pubdate": "2026-08-13T22:17:25.810Z",
  "executiveSummary": "A second-order SQL injection vulnerability exists in the Budibase low-code platform prior to version 3.39.18. The flaw resides within the MySQL integration component, specifically handling table names during schema discovery operations. An authenticated or unauthenticated attacker capable of creating a maliciously crafted MySQL table containing backticks and stacked SQL statements can trigger arbitrary command execution. The risk implications include potential unauthorized data access, modification, or destruction within the database environment. Exploitation requires the attacker to successfully provision a specially named table in an accessible database and wait for a Budibase administrator to subsequently initiate a schema discovery routine. Upon execution of the schema discovery process, the unescaped table name is concatenated directly into a DESCRIBE statement with multiple statements enabled, leading to the execution of the injected payload. Remediation requires upgrading the Budibase server package to version 3.39.18 or higher, which properly implements identifier quotation.",
  "technicalDetails": "The vulnerability is rooted in the database integration layer of Budibase, specifically within the packages/server/src/integrations/mysql.ts file. Prior to version 3.39.18, the underlying MySQL connection configuration enabled the multipleStatements option, allowing the execution of multiple semicolon-delimited SQL queries within a single database request. During schema discovery routines, the application dynamically constructs SQL queries by directly interpolating the table name into a DESCRIBE statement without performing adequate sanitization or escaping.\nThe root cause is the lack of proper identifier quoting for the tableName variable prior to query construction. An attacker exploits this behavior by creating a MySQL table whose identifier contains malicious SQL syntax, typically incorporating backticks to break out of the identifier context and semicolons to inject stacked statements. Once the malicious table is provisioned within a target database accessible to the Budibase instance, the attacker must wait for a Budibase administrator to trigger schema introspection or table discovery. When the administrator initiates this routine, the application queries the database schema and evaluates the malicious table name.\nThe attack flow proceeds as follows: First, the attacker creates a table with a payload injected into the table identifier. Second, the attacker waits for a privileged Budibase administrator to execute schema discovery. Third, the application queries the database using the vulnerable packages/server/src/integrations/mysql.ts component. Fourth, the unescaped table name containing stacked statements is processed by the database driver because multipleStatements is enabled. Fifth, the database executes both the original DESCRIBE query and the attacker-supplied secondary statements with the privileges of the database user configured in Budibase.\nThe affected component is the MySQL integration module located at packages/server/src/integrations/mysql.ts in Budibase versions prior to 3.39.18. Exploitation relies on database-level privileges to create tables and administrative interaction within Budibase to trigger the schema discovery mechanism. The post-exploitation impact depends on the database privileges granted to the Budibase connection string, potentially ranging from read-write access to underlying application data up to administrative database compromise."
}