Critical SQL Injection Found in Budibase

A critical SQL injection vulnerability has been identified in the Budibase server, tracked under advisory ID GHSA-q6x4-v3qx-85qw. The flaw stems from the MySQL integration component being configured with the multipleStatements property set to true, which permits the execution of chained SQL queries through user-supplied input.

What's at Risk

The vulnerability affects the npm/@budibase/server package. Organizations utilizing Budibase with a MySQL backend are at significant risk, particularly those with internet-facing instances where user input can reach the database layer. Because the configuration explicitly enables multiple statements, any input field vulnerable to SQL injection can be weaponized to bypass intended query structures.

How the Flaw Works

SQL injection occurs when an application fails to properly sanitize or parameterize user input before including it in a database query. When an application is configured to allow multiple statements, an attacker can append a semicolon followed by a malicious command to a legitimate query. This class of vulnerability generally allows unauthorized parties to manipulate the database schema, extract sensitive information, or disrupt service availability. In many cases, this level of access provides an attacker with the ability to perform administrative actions, such as granting themselves elevated privileges or deleting entire tables of data, effectively bypassing the application's intended security logic.

How to Protect Your Systems

• Review your current Budibase server configuration for the multipleStatements: true setting in the MySQL integration.
• Temporarily disable the MySQL integration if immediate patching is not possible to prevent potential exploitation.
• Set multipleStatements to false in your configuration files as a direct remediation step.
• Implement strict input validation and sanitization for all user-facing fields that interact with your database.
• Monitor database access logs for unusual query patterns or unexpected administrative commands.
• Follow vendor security advisories closely for updates regarding a permanent patch for the affected package.

Given the critical CVSS score of 9.6, this vulnerability represents a severe threat to data integrity and confidentiality. Promptly addressing this configuration error is essential to prevent unauthorized access and ensure the security of the underlying database infrastructure.