CVE-2021-42258

CVE-2021-42258 is a critical-severity (CVSS 9.8) vulnerability in BQE BillQuick Web Suite. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 17, 2021. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly.

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
• https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42258