Budibase server before version 3.45.0 constructs MySQL and MSSQL column-rename DDL statements by directly interpolating identifiers into raw query strings without using the project's identifier-quoting helpers. An attacker with DDL rights can create a column name containing special characters (backtick for MySQL, single quote for MSSQL) plus additional SQL code. Budibase stores this name verbatim, and when a user renames the column via the UI, the embedded quote prematurely terminates the identifier, causing the injected SQL to execute. Because the MySQL connection allows multiple statements, the attacker can run stacked SQL commands as the Budibase datasource user, enabling arbitrary database reads, writes, or destructive actions outside Budibase's row/table permission controls. The vulnerability is resolved in version 3.45.0.

Exploitation allows an attacker with DDL rights on a connected MySQL or MSSQL datasource to execute arbitrary SQL commands with the privileges of Budibase's datasource user. This can lead to unauthorized data access, modification, or destruction beyond Budibase's built-in permission model. The vulnerability affects the integrity, confidentiality, and availability of the connected database.

This vulnerability is fixed in Budibase server version 3.45.0. Users should upgrade to version 3.45.0 or later to remediate the issue. No additional mitigations are required once the update is applied.