Budibase's MySQL integration component is configured with `multipleStatements: true`, which permits execution of multiple SQL statements in a single query. This configuration enables attackers to perform SQL injection attacks by injecting malicious SQL commands through user input fields. The vulnerability is located in the file `packages/server/src/integrations/mysql.ts` at line 173. Exploitation can result in executing destructive commands such as DROP TABLE, unauthorized data exfiltration, privilege escalation, and denial of service. The recommended fix is to set `multipleStatements` to false, preventing execution of multiple statements in a single query.

The vulnerability allows remote attackers to execute arbitrary SQL commands, leading to potential data destruction (e.g., dropping tables), data theft (e.g., exfiltrating data), privilege escalation within the database, denial of service by disrupting database operations, and complete compromise of the database. These impacts can severely affect the confidentiality, integrity, and availability of the affected systems.

A patch is available that disables the `multipleStatements` option by setting it to false in the MySQL integration configuration (`multipleStatements: false`). This change prevents execution of multiple SQL statements in a single query, mitigating the SQL injection risk. Additional workarounds include temporarily disabling the MySQL integration, implementing a web application firewall (WAF) to filter malicious inputs, and restricting database user privileges to limit potential damage.