PT-2021-4673 · Bqe · Bqe Billquick Web Suite

Caleb Stewart

·

Published

2021-10-22

·

Updated

2025-11-10

·

CVE-2021-42258

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions BQE BillQuick Web Suite versions 2018 through 2021 before 22.0.9.1
Description The issue allows SQL injection for unauthenticated remote code execution, which has been exploited in the wild in October 2021 for ransomware installation. SQL injection can use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp cmdshell(). The vulnerability is related to errors in neutralizing special elements in SQL queries. It is estimated that 400,000 users worldwide may be affected, as the products are widely used.
Recommendations For BQE BillQuick Web Suite versions 2018 through 2021 before 22.0.9.1, update to version 22.0.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the txtID parameter in the login form to minimize the risk of exploitation. Restrict access to the xp cmdshell() procedure to prevent remote code execution.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2021-05366
CVE-2021-42258

Affected Products

Bqe Billquick Web Suite