CVE-2021-42258

Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score85.1160%

EPSS Percentile87.56th

Published2021年10月22日

Last Modified2025年11月10日

Vulnerability Description

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

Affected Platforms (CPE)

📦

Bqe

Billquick Web Suite

>= 19 and < 22.0.9.1

References & Advisories

🔗 https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42258

Vulnerability Description

Affected Platforms (CPE)

Billquick Web Suite

References & Advisories

関連する脆弱性情報