Executive brief
Budibase is a low-code platform that lets users build database-driven applications. An attacker with database DDL (create/modify table) rights can plant malicious SQL code in a column name, which Budibase stores verbatim. When a Budibase builder later renames that column via the UI, the embedded SQL executes against the connected database with Budibase's database credentials, allowing the attacker to read, modify, or delete data without restriction.
Technical details
Second-order SQL identifier injection in sqlTable.ts where MySQL and MSSQL column-rename operations interpolate identifiers directly into raw query strings without applying quoteMySqlIdentifier/quoteSqlServerIdentifier helpers. An attacker with DDL rights creates a column name containing a backtick (MySQL) or single quote (MSSQL) followed by stacked SQL; when a builder renames that column via POST /api/tables, the quote character breaks the identifier context and executes the injected SQL as Budibase's datasource user on the external database. MySQL multipleStatements: true enables full stacked query execution.
Affected products
- Budibase @budibase/server before 3.45.0
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 3.45.0