CVE-2021-42258 KEV
9.8
CRITICAL · CVSS 3.1 · EPSS 74.4% (pctl 99)
Patch first
On CISA KEV — known exploited in the wild, due 2021-11-17.
Description
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 74.43% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | yes — remediate by 2021-11-17 |
| Public exploit | none known |
| Published | 2021-10-22 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | BQE BillQuick Web Suite SQL Injection Vulnerability |
|---|---|
| Added | 2021-11-03 |
| Due | 2021-11-17 |
| Vendor / product | BQE / BillQuick Web Suite |
| Ransomware use | known |
Affected (1)
| Vendor | Product |
|---|---|
| bqe | billquick web suite |
References
- https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
- https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42258
→ the Explorer · watch your stack · NVD