The Budibase server's MySQL integration enables multipleStatements on the database connection, allowing execution of multiple semicolon-separated SQL statements in one query. During schema introspection, table names from INFORMATION_SCHEMA.TABLES are used in DESCRIBE queries with backticks, but embedded backticks in table names are not escaped. An attacker who can create tables in the MySQL database can name a table with embedded backticks and malicious SQL, causing the DESCRIBE query to break out of the identifier context and execute attacker-controlled SQL statements. This vulnerability enables arbitrary SQL execution triggered during normal schema discovery operations by an administrator, without requiring direct control of the Budibase datasource configuration.

An attacker with the ability to create tables in the MySQL database can execute arbitrary SQL commands during schema introspection by an administrator. This can lead to data loss, data corruption, or other high-impact consequences due to arbitrary SQL execution. The vulnerability affects confidentiality, integrity, and availability of the database. It requires the attacker to have some database privileges to create tables but does not require direct control over Budibase configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid creating or allowing untrusted users to create tables with malicious names in the MySQL database used by Budibase. Administrators should exercise caution when performing schema introspection on databases with potentially untrusted table names. Monitor vendor channels for an official patch or update addressing this issue.