A critical SQL injection vulnerability in Budibase server allows unauthenticated attackers to execute arbitrary database commands, posing a severe risk of data compromise and system persistence.

The vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89) within webhook-triggered automations. Although the CVSS vector indicates low privileges are required, the description confirms the attack vector is unauthenticated, allowing remote actors to inject malicious payloads into database queries.

Successful exploitation grants an attacker the ability to interact directly with the underlying database using the application's configured credentials. This can lead to total data exfiltration, unauthorized modification of sensitive information, or the establishment of long-term persistence within the database environment. With a CVSS score of 10.0, this flaw represents the highest level of risk to business operations and data confidentiality.

Immediate Action: Update Budibase server to version 3.40.0 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review application logs for anomalous POST requests sent to webhook endpoints and monitor database query logs for unusual or unexpected execution patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict input validation rules to block malformed JSON payloads targeting webhook endpoints.

Public Exploit Available: Unknown.

The severity of this vulnerability cannot be overstated given the potential for full database compromise. Administrators must prioritize the application of the 3.40.0 update across all production environments to eliminate the injection vector.