Description
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Budibase | budibase | < 3.40.0 | 3.40.0 |
References
- GitHub Security Advisory (GHSA-xj29-x47g-9w2c) vendor-advisory
- VulnCheck Advisory: Budibase before 3.40.0 SQL Injection via Oracle connector third-party-advisory