Budibase has a Command Injection in PostgreSQL Dump Command

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Budibase 操作系统命令注入漏洞

Budibase是英国Budibase开源的一个用于在几分钟内创建内部应用程序、工作流和管理面板的低代码平台。 Budibase 3.23.22及之前版本存在操作系统命令注入漏洞，该漏洞源于PostgreSQL集成在构造shell命令时未对用户控制的配置值进行适当清理，可能导致命令注入攻击。

N/A

N/A