BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th
Affects BillQuick Web Suite 2018 through 2021 before 22.0.9.1 when configured to use the sa MSSQL user for database authentication. The fix is in 22.0.9.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 22.0.9.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
BQE BillQuick Web Suite, a web-based time and billing application, is affected by a SQL injection flaw that lets an unauthenticated remote attacker run arbitrary code on the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 1
Questions about CVE-2021-42258
What does this mean?
The main login form's username field allows blind SQL injection, meaning crafted input can alter database queries. Through this, an attacker can access BillQuick data and run commands on the underlying Windows server, including via xp_cmdshell.Source: huntress.com
Am I affected, and how do I check?
The advisory covers BillQuick Web Suite 2018 through 2021 before 22.0.9.1, where BillQuick used the sa (System Administrator) MSSQL user for database authentication. To check, compare the installed BillQuick Web Suite version with 22.0.9.1 and review the database account BillQuick is configured to use.Source: huntress.com
What should I do about it?
Upgrade to BillQuick Web Suite 22.0.9.1, which contains the code changes the advisory describes as the fix.Source: huntress.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data