| Package | Affected versions | Patched versions |
|---|---|---|
| budibase | < 3.39.19 | 3.39.19 |
This advisory covers three distinct SQL Injection vulnerabilities within Budibase's database connectors (PostgreSQL, Microsoft SQL Server, and MySQL). Because user-controlled schema and table configurations are interpolated directly into raw SQL queries without proper escaping or parameterization during database introspection, an authenticated administrator can break out of string delimiters. This allows for arbitrary DDL/DML execution, database compromise, and potential underlying OS command execution (e.g., via MS SQL xp_cmdshell).
PostgreSQL SET search_path SQL Injection
The schema datasource config field is interpolated directly into a raw SQL statement without proper escaping. Double quotes inside the schema name are not escaped, allowing an attacker to break out of the string literal and inject arbitrary SQL.
Vulnerable Code:
File: packages/server/src/integrations/postgres.ts, lines 355–358
const search_path = this.config.schema
.split(",")
.map(item => `"${item.trim()}"`) // NO escaping of embedded "
await this.client.query(`SET search_path TO ${search_path.join(",")};`)
node-postgres sends this via the simple query protocol, which supports multi-statement execution with semicolons.
public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --SET search_path TO "public"; CREATE TABLE pwned AS SELECT usename, passwd FROM pg_shadow; --;pg_shadow hashes, call pg_read_file(), or execute any DDL/DML.Microsoft SQL Server Schema Introspection SQL Injection
Three methods used during schema introspection (buildSchema) interpolate user-controlled values directly into SQL strings using single-quote delimiters with no escaping.
Vulnerable Code: File: , lines 388–414
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freepackages/server/src/integrations/microsoftSqlServer.tsgetDefinitionSQL(tableName: string, schemaName: string) {
return `select * from INFORMATION_SCHEMA.COLUMNS
where TABLE_NAME='${tableName}' AND TABLE_SCHEMA='${schemaName}'`
}
schemaName comes directly from this.config.schema (user config).
dbo'; EXEC xp_cmdshell('whoami'); --xp_cmdshell is enabled.xp_cmdshell.MySQL multipleStatements: true + DESCRIBE Backtick Injection
The MySQL integration enables multipleStatements: true, allowing semicolon-separated multi-statement execution. When introspecting tables, table names are interpolated into a DESCRIBE query wrapped in backticks, but the backticks are not escaped.
Vulnerable Code:
File: packages/server/src/integrations/mysql.ts, lines 172, 305
this.config = { ...config, multipleStatements: true, ... } // line 172
...
{ sql: `DESCRIBE \`${tableName}\`;` } // line 305 — backtick NOT escaped
foo`; DROP TABLE users; --.INFORMATION_SCHEMA.TABLES and inserts it into the DESCRIBE query.DROP TABLE payload executes.