Budibase SQL injection in MySQL and MSSQL column-rename DDL
Budibase before 3.45.0 interpolates column identifiers directly into ALTER TABLE rename statements for MySQL and MSSQL, enabling SQL injection by users with schema-edit access.
- Vendor
- Budibase
- Product
- Budibase Server (versions before 3.45.0)
- CVSS
- 8.0
- EPSS (exploit probability)
- 0.2%
- Status
- patched
- Published
Budibase Server before 3.45.0 builds MySQL and MSSQL column-rename DDL by interpolating column identifiers directly into raw query strings using backtick quoting in packages/backend-core/src/sql/sqlTable.ts. A user with schema-edit permissions can supply a column name containing SQL metacharacters that break out of the backtick context and inject arbitrary SQL into the resulting ALTER TABLE ... RENAME COLUMN statement.
The issue is present in the MySQL and MSSQL code paths. PostgreSQL uses a different quoting approach and is not reported as affected. Budibase 3.45.0 addresses the flaw by using parameterized identifiers for column names in rename operations. Instances that do not connect to MySQL or MSSQL datasources are not affected.
The advisory notes no evidence of active exploitation. This CVE is not listed in the CISA KEV catalog at publication.
