GHSA-2xgg-r2wc-c5r2: Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection), reported in the same original disclosure and split per GitHub CNA guidance (rule 4.2.11) since it affects a separate integration, has a distinct attack precondition, and requires a separate patch.

The MySQL integration enables multipleStatements: true on the connection, permitting semicolon-separated multi-statement execution. During table introspection, table names retrieved from INFORMATION_SCHEMA.TABLES are interpolated into a DESCRIBE query wrapped in backticks, but embedded backticks in the table name are never escaped — allowing a malicious table name to break out and inject a second, attacker-controlled statement.