CVE-2021-42258

· CRITICALAnalyzed

← All CVEs

CVSS v3.1

9.8

EPSS

74.43%

Published

Oct 22, 2021

Modified

Nov 10, 2025

CISA Known Exploited Vulnerability

Added: 2021-11-03 · Due: 2021-11-17

Apply updates per vendor instructions.

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index NucleiNuclei detection template

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89CWE-89

Affected Products (1)

bqe · billquick_web_suite (up to 22.0.9.1)vulnerable

References (3)

https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware

ExploitThird Party Advisory

https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware

ExploitThird Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42258

US Government Resource

KEV Catalog EPSS Scores Vendors All CVEs