Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.

Affected: npm: @budibase/server

### Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection), reported in the same original disclosure and split per GitHub CNA guidance (rule 4.2.11) since it affects a separate integration, has a distinct attack precondition, and requires a separate patch.**

The MySQL integration enables `multipleStatements: true` on the connection, permitting semicolon-separated multi-statement execution. During table introspection, table names retrieved from `INFORMATION_SCHEMA.TABLES` are interpolated into a `DESCRIBE` query wrapped in backticks, but embedded backticks in the table name are never escaped — allowing a malicious table name to break out and inject a second, attacker-controlled statement.

### Details

**Vulnerable Code:** File: `packages/server/src/integrations/mysql.ts`, lines 172, 305

```typescript this.config = { ...config, multipleStatements: true, ... } // line 172 ... { sql: `DESCRIBE \`${tableName}\`;` } // line 305 — backtick NOT escaped ```

Because `multipleStatements` is enabled, any statement appended after the backtick break-out executes as a second query in the same round trip.

### Step-by-Step Reproduction 1. An attacker with the ability to create tables in the target MySQL database (e.g. a lower-privileged database user, or a malicious actor in a multi-tenant database) creates a table named: ``foo`; DROP TABLE users; --`` 2. In Budibase, an administrator triggers schema introspection…