Critical SQL Flaw Exposed in Budibase

A severe security vulnerability has been identified within the MySQL integration component of Budibase, posing a significant risk to database integrity. The issue centers on how the platform manages database queries, potentially allowing remote actors to inject and execute arbitrary SQL commands.

Configuration Error Enables Injection

The core of the vulnerability resides in the packages/server/src/integrations/mysql.ts file, specifically at line 173. The application was configured with the multipleStatements parameter set to true, which permits the execution of several SQL statements within a single query operation. By manipulating user input fields, an attacker could potentially bypass intended query constraints, leading to a complete compromise of the underlying database.

Technical Scope of the Risk

The flaw is classified as critical, carrying a CVSS 9.6 severity rating. Because the configuration explicitly enables the processing of multiple statements, it creates an environment where malicious payloads can be appended to legitimate queries. Proof-of-concept demonstrations indicate that this could facilitate operations ranging from data exfiltration to the destruction of entire database tables.

• Severity Rating: CVSS 9.6
• Vulnerable File: packages/server/src/integrations/mysql.ts
• Vulnerable Configuration: multipleStatements: true

Potential Consequences for Data

The impact of this vulnerability extends to the full control of affected database instances. Attackers could utilize the flaw to perform several high-impact actions, including unauthorized privilege escalation or the complete denial of service. Additionally, the ability to execute destructive commands like DROP TABLE poses a direct threat to the availability and confidentiality of the stored information.

Managing the Security Exposure

This discovery highlights the importance of maintaining strict query execution policies within application integrations. For those relying on Budibase's MySQL functionality, the primary mitigation involves ensuring that the multipleStatements configuration is set to false. As of the current advisory, no permanent patch is listed in the official records, making it essential for administrators to monitor the situation and consider temporary measures such as disabling the integration if exposure cannot be otherwise managed. This suggests that the security posture of any application depends heavily on the default configurations of its internal components, where even a single enabled flag can fundamentally alter the risk profile of the entire system.