Budibase versions prior to 3.40.0 contain a SQL injection flaw in the Oracle data‑source connector. The flaw lies in the post‑write row lookup routine, where table and column identifiers are not properly escaped when a table name includes a double quote. An attacker who has write permission on a table with a double‑quoted name can supply a payload that is concatenated into the SQL sent to the database, leading to arbitrary SQL execution under the database user account for that data source. The effect is that the attacker can read or modify any data accessible to that database role, compromising confidentiality, integrity, and potentially availability of the application data. The weakness maps to CWE‑89: Improper Neutralization of Special Elements used in an SQL Command.

The vulnerability affects Budibase installations running any version older than 3.40.0, specifically those configured with an Oracle data source connector. The issue is tied to the Budibase application itself, not to the Oracle database server. Users of Budibase who interact with Oracle data sources and where tables may contain a double quote in the name are at risk.

The CVSS base score of 8.8 indicates high severity, and though the EPSS score is not available, the lack of a KEV listing does not diminish the risk for active attackers. Exploitation requires that the attacker owns or can alter a table whose name contains a double quote; the write permission is the primary prerequisite. Once the write condition is met, the attacker can inject SQL that runs as the data source’s database user, giving them broad authority over the database. The vulnerability is local within the application context but can be leveraged by authenticated users or compromised accounts with sufficient write rights.