critical9.8Known exploited
CVE-2021-42258
BQE BillQuick Web Suite SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2021-11-17.
Apply updates per vendor instructions.
Impact
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bqe | Billquick Web Suite | from 19 before 22.0.9.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
- https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42258