{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/budibase-server--3.38.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Budibase Server (\u003c= 3.38.1)","MySQL"],"_cs_severities":["critical"],"_cs_tags":["sql-injection","web-application","vulnerability","nosql-injection","data-exfiltration","data-destruction","application-vulnerability","csrft","budibase","web-vulnerability","identity-theft","impersonation"],"_cs_type":"advisory","_cs_vendors":["Budibase","Oracle"],"content_html":"\u003cp\u003eA critical SQL injection vulnerability, identified in Budibase's MySQL integration in versions up to and including 3.38.1, allows remote attackers to execute arbitrary SQL commands. The vulnerability stems from the MySQL client configuration within Budibase, specifically setting \u003ccode\u003emultipleStatements: true\u003c/code\u003e in the \u003ccode\u003emysql.ts\u003c/code\u003e file, which permits the execution of multiple SQL statements in a single query. Attackers can leverage this misconfiguration by injecting malicious SQL payloads into user input fields, bypassing typical query sanitization. This vulnerability can lead to severe consequences, including complete database compromise, data destruction, data theft, privilege escalation, and denial of service, posing a significant risk to organizations using affected Budibase deployments. The vulnerability was publicly disclosed by GitHub Security Advisories (GHSA).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a public-facing Budibase application utilizing the vulnerable MySQL integration.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious SQL injection payload designed to execute multiple statements.\u003c/li\u003e\n\u003cli\u003eThe crafted payload is inserted into a user-controlled input field within the Budibase application (e.g., a search box, login form, or data entry field).\u003c/li\u003e\n\u003cli\u003eThe Budibase backend processes the user input, which is then passed directly to the MySQL client configured with \u003ccode\u003emultipleStatements: true\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe MySQL database server executes all statements within the crafted payload, including the legitimate application query and the attacker's malicious commands.\u003c/li\u003e\n\u003cli\u003eMalicious commands execute, leading to potential data exfiltration (e.g., \u003ccode\u003eSELECT INTO OUTFILE\u003c/code\u003e), data modification/destruction (e.g., \u003ccode\u003eDROP TABLE\u003c/code\u003e, \u003ccode\u003eDELETE\u003c/code\u003e), or privilege escalation (e.g., \u003ccode\u003eGRANT ALL PRIVILEGES\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker achieves complete control over the application's underlying database, leading to data compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of this SQL injection vulnerability grants attackers complete control over the Budibase application's underlying MySQL database. This can result in significant damage, including the total destruction of data through \u003ccode\u003eDROP TABLE\u003c/code\u003e or \u003ccode\u003eDELETE\u003c/code\u003e commands, widespread data theft via \u003ccode\u003eSELECT INTO OUTFILE\u003c/code\u003e, and the ability to escalate database privileges. Furthermore, attackers can cause denial of service by disrupting database operations, rendering the application unusable. All data stored within the compromised database is at risk, potentially affecting a wide range of sensitive business information and user data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Budibase Server to a version patched against GHSA-q6x4-v3qx-85qw (greater than 3.38.1) immediately to remediate the \u003ccode\u003emultipleStatements: true\u003c/code\u003e misconfiguration.\u003c/li\u003e\n\u003cli\u003eTemporarily disable the MySQL integration within Budibase if immediate patching is not feasible, referencing the 'Remediation' section of the source advisory.\u003c/li\u003e\n\u003cli\u003eImplement or strengthen a Web Application Firewall (WAF) to detect and block SQL injection patterns in HTTP request parameters, leveraging webserver log sources.\u003c/li\u003e\n\u003cli\u003eReview and restrict the database user privileges for the Budibase application to the absolute minimum necessary functions, limiting the potential impact of future injection vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:45:32Z","date_published":"2026-07-24T21:19:19Z","id":"https://feed.craftedsignal.io/briefs/2026-07-budibase-sql-injection/","summary":"A critical SQL injection vulnerability was discovered in Budibase's MySQL integration (versions \u003c= 3.38.1) that allows remote attackers to execute arbitrary SQL commands through user input fields due to the `multipleStatements: true` configuration, leading to complete database compromise.","title":"SQL Injection Vulnerability in Budibase MySQL Integration","url":"https://feed.craftedsignal.io/briefs/2026-07-budibase-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Budibase Server (\u003c= 3.38.1)","version":"https://jsonfeed.org/version/1.1"}