Critical severity · published Oct 22, 2021
CVE-2021-42258
BQE BillQuick Web Suite SQL Injection Vulnerability
RansomwareIn wildKEV
9.8
CVSS
74.3%
EPSS
Yes
On KEV
Description
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)74.3% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueNov 17, 2021
Ransomware campaign useKnown
Affected products
Which versions
BW
Billquick Web Suite · Bqe
19 before 22.0.9.1 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-42258
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-42258
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware