fkie_cve-2026-73300

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.

GHSA-q6x4-v3qx-85qw — Budibase: SQL Injection via `multipleStatements: true`

Affected: npm: @budibase/server

## Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands.

## Details ### Vulnerability Type SQL Injection

### Description The MySQL integration component in Budibase is configured with `multipleStatements: true`, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise.

### Location ```typescript // File: packages/server/src/integrations/mysql.ts // Line: 173

this.config = { ...config, typeCast: defaultTypeCasting, multipleStatements: true, // VULNERABLE timezone: "Z", } ```

## Proof of Concept

### Exploit ```javascript const mysql = require('mysql2');

// Budibase vulnerable configuration const connection = mysql.createConnection({ host: 'localhost', user: 'root', password: 'password', multipleStatements: true, // Vulnerable setting timezone: "Z" });

// Attack: Data destruction connection.query( `SELECT * FROM users WHERE id = 1; DROP TABLE sensitive_data; --`, (err, results) => { if (!err) console.log("Table dropped successfully"); } ); ```

## Impact - **Data Destruction**: Execute DROP TABLE, DELETE commands - **Data Theft**: Exfiltrate data via SELECT INTO OUTFILE - **Privilege Escalation**: Grant database admin privileges - **Denial of Service**: Disrupt service operations - **Complete Database Compromise**: Full c…

Most recent entries from all

fkie_cve-2026-73300

GHSA-q6x4-v3qx-85qw — Budibase: SQL Injection via `multipleStatements: true`