EUVD-2026-58503
GHSA-mv4c-5rgh-72q9
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H and AC:H reflect required write privileges and double-quote table-name precondition; S:C captures injection executing as the Oracle database user beyond Budibase's application boundary.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.
AnalysisAI
SQL injection in Budibase's Oracle datasource connector (versions before 3.40.0) exposes the underlying Oracle database to arbitrary read and write operations by authenticated platform users. The post-write row lookup query concatenates table names into SQL identifiers without escaping double-quote characters, enabling injection of arbitrary SQL that executes under the datasource's Oracle database user account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the simultaneous presence of three specific conditions: (1) the attacker must hold Budibase write-level permissions (PR:H) on a table connected to an Oracle datasource - standard viewer or read-only roles are insufficient; (2) the targeted table's name must contain a double-quote character, which is syntactically valid in Oracle but atypical in standard naming conventions; and (3) the Budibase instance must be configured with an active Oracle datasource connector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:P) captures both the severity ceiling and the practical exploitation barriers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or compromised account holding Budibase write permissions identifies or provisions an Oracle-connected table whose name includes a double-quote character. By submitting a crafted write operation to that table, the attacker causes the Oracle connector to construct a malformed post-write lookup query in which the unescaped double-quote breaks the identifier boundary, injecting attacker-controlled SQL. … |
| Remediation | The primary fix is to upgrade Budibase to version 3.40.0 or later, which resolves the identifier-escaping defect in the Oracle connector's post-write row lookup. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Budibase deployments using Oracle connectors and review database access logs for anomalous SQL activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today