CVE-2021-42258

🗓️ 22 Oct 2021 00:00:00Reported by AttackerKBType

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, exploited in the wild in October 2021 for ransomware installation. SQL injection can use the txtID parameter

Reporter	Title	Published	Views	Family All 17
CVE	CVE-2021-42258	22 Oct 202122:15	–	cve
Prion	Sql injection	22 Oct 202122:15	–	prion
Vulnrichment	CVE-2021-42258	22 Oct 202121:25	–	vulnrichment
Cvelist	CVE-2021-42258	22 Oct 202121:25	–	cvelist
Packet Storm	BillQuick Web Suite txtID SQL Injection	31 Aug 202400:00	–	packetstorm
Metasploit	BillQuick Web Suite txtID SQLi	6 Nov 202110:29	–	metasploit
The Hacker News	Hackers Exploited Popular BillQuick Billing Software to Deploy Ransomware	25 Oct 202108:19	–	thn
CISA KEV Catalog	BQE BillQuick Web Suite SQL Injection Vulnerability	3 Nov 202100:00	–	cisa_kev
Check Point Advisories	BillQuick Website SQL injection (CVE-2021-42258)	25 Nov 202100:00	–	checkpoint_advisories
Nuclei	BillQuick Web Suite SQL Injection	26 Oct 202108:26	–	nuclei

Source	Link
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
huntress	www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

22 Oct 2021 00:00Current

9.9High risk

Vulners AI Score9.9

CVSS26.8

CVSS39.8

EPSS0.93901