CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.40.0 are vulnerable to a SQL injection flaw in the Oracle datasource connector, which inadequately escapes table names in identifiers. This vulnerability allows attackers with write permissions to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification. Organizations using affected versions should prioritize patching to mitigate the risk of data breaches and integrity issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.