EUVD-2026-87656
GHSA-8mm2-5qwq-x6xp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H and UI:R because a builder must trigger the rename on a pre-planted name; PR:L for attacker DDL rights on the datasource; S:C and C/I/A:H as injected SQL fully compromises the separate connected database.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename literal for MSSQL) without applying the project's quoteMySqlIdentifier / quoteSqlServerIdentifier helpers. An attacker with DDL rights on a connected MySQL/MSSQL datasource can create a column whose name contains a backtick (MySQL) or single quote (MSSQL) plus additional SQL; Budibase's schema introspection stores the name verbatim, and when a Budibase builder later renames that column through the UI (POST /api/tables with _rename.old), the embedded quote character terminates the identifier and the injected SQL is executed. Because the MySQL connection is opened with multipleStatements: true, stacked statements run as Budibase's datasource user, allowing arbitrary reads, writes, or destructive operations on the connected database outside Budibase's row/table permission model. Fixed in 3.45.0.
AnalysisAI
Second-order SQL injection in Budibase Server (@budibase/server) before 3.45.0 can let an authenticated attacker with DDL rights on a connected MySQL or MSSQL datasource create a malicious column name that escapes identifier quoting, then execute injected SQL when a Budibase builder later renames that column through the UI. Because the MySQL connection is opened with multipleStatements:true in this default case, stacked statements can run as the datasource user and bypass Budibase's row/table permission model, enabling arbitrary reads, writes, or destructive operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a MySQL or MSSQL datasource connected to Budibase where the attacker holds DDL (CREATE/ALTER) rights to define a column name containing a backtick (MySQL) or single quote (MSSQL) plus injected SQL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-impact second-order SQL injection (CWE-89) rather than an inflated high-CVSS finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Budibase 3.45.0 or later, which fixes the identifier-quoting issue in packages/backend-core/src/sql/sqlTable.ts; vendor-released patch: 3.45.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Budibase Server deployments and confirm which instances are running versions below 3.45.0, then schedule the upgrade to 3.45.0 (or later) as the primary remediation; in parallel, identify every MySQL and MSSQL datasource connection configured in Budibase and record which accounts and roles have DDL rights, disabling multipleStatements on MySQL connections and granting datasource accounts only the minimum privileges required by the application. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today