CyberRota Analysis
AI-GeneratedBudibase Server versions prior to 3.40.0 are vulnerable to a NoSQL injection flaw in the MongoDB query execution endpoint, where unsanitized user input can manipulate JSON query templates. This vulnerability allows attackers with query write permissions to inject JSON structural characters, potentially leading to unauthorized access, modification, or deletion of documents. Organizations using affected versions of Budibase Server should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.