Executive brief
Budibase is a low-code platform for building business applications and automations. The database connector feature allows administrators to query PostgreSQL, Microsoft SQL Server, and MySQL databases directly. Due to improper input sanitization, an authenticated administrator can inject arbitrary SQL commands by manipulating database schema configuration fields, leading to full database compromise, credential theft, or OS command execution.
Technical details
Three distinct SQL injection vulnerabilities exist in Budibase's database connectors (CWE-89). In PostgreSQL, the schema configuration is interpolated directly into a SET search_path query without escaping double-quote characters, allowing an attacker to break the string literal and inject arbitrary SQL via the simple query protocol. In MS SQL Server, schema and table names are interpolated into INFORMATION_SCHEMA queries using single quotes with no escaping, enabling arbitrary SQL and potentially OS command execution via xp_cmdshell. In MySQL, multipleStatements is enabled and table names are wrapped in unescaped backticks, allowing secondary statement injection during schema introspection. All three require authentication as an administrator with datasource configuration access, and user interaction (triggering connection test or schema introspection). Patches are available in version 3.39.19 and later.
Affected products
- Budibase budibase <3.39.19
Timeline
- 2026-06-18: disclosed: GHSA-qqf5-x7mj-v43p published
- 2026-06-18: patched: Fixed in version 3.39.19