CVE-2021-42258
BQE BillQuick Web Suite SQL Injection Vulnerability
Description
CVE-2021-42258 is a CRITICAL SQL injection vulnerability affecting BQE BillQuick Web Suite, carrying a CVSS 3.1 score of 9.8. BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution via the txtID (username) parameter. This vulnerability was exploited in the wild in October 2021 for ransomware installation, with successful exploitation enabling arbitrary code execution as MSSQLSERVER$ via xp_cmdshell. Affected products include BQE BillQuick Web Suite (>= 19, < 22.0.9.1). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.93812 (99.86th percentile), this vulnerability demonstrates extremely high real-world exploitation probability and demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| bqe | billquick web suite | >= 19, < 22.0.9.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42258(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-42258 is classified under CWE-89 — SQL Injection. SQL Injection occurs when user-controllable input is incorporated into SQL queries without proper sanitization or parameterization. Attackers can inject malicious SQL statements that are then executed by the database engine, allowing them to read, modify, or delete data, bypass authentication, or in severe cases execute operating system commands. SQL Injection has been one of the most prevalent and dangerous vulnerability classes for over two decades.
In the context of BQE BillQuick Web Suite, this weakness is particularly critical because the SQL injection vulnerability in the username (txtID) parameter allows unauthenticated attackers to execute arbitrary code on the underlying MSSQL Server via xp_cmdshell. This means the vulnerability provides a direct path from unauthenticated web access to full operating system command execution, making it an ideal entry point for ransomware operators and other threat actors.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
Impact Analysis
CVE-2021-42258 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants attackers complete access to the BillQuick database, including sensitive financial data, client records, billing information, and any credentials stored within the application.
Integrity (HIGH): Attackers can modify database records, alter financial data, create unauthorized accounts, and through xp_cmdshell, install backdoors, ransomware, or other malware on the underlying server.
Availability (HIGH): Complete disruption of billing operations is possible, including database destruction, ransomware encryption of critical files, and denial of service to all BillQuick users.
Scope Unchanged: The vulnerability's scope is Unchanged (U), meaning exploitation is technically contained within the vulnerable component. However, the ability to execute OS commands via xp_cmdshell effectively extends impact to the entire hosting environment.
With an EPSS score of 0.93812 (99.86th percentile), this vulnerability ranks among the most exploited vulnerabilities tracked and has been directly linked to ransomware campaigns.
Exploit Maturity
CVE-2021-42258 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was actively exploited in October 2021 for ransomware deployment. Security researchers at Huntress documented real-world attacks leveraging this SQL injection flaw to gain initial access and deploy ransomware payloads on victim organizations.
Ransomware association: CVE-2021-42258 is directly associated with ransomware campaigns. Threat actors exploited the SQL injection vulnerability to execute commands via MSSQL Server's xp_cmdshell, enabling them to deploy ransomware across affected environments. This confirmed ransomware nexus significantly elevates the risk.
Attack surface: The vulnerability requires no authentication and targets the login page's username parameter, making it trivially exploitable. Public exploit information and proof-of-concept details are available, lowering the barrier for exploitation by less sophisticated threat actors.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. Given the confirmed ransomware exploitation, all organizations using BillQuick Web Suite should treat remediation as an emergency priority.
Remediation
- Upgrade BillQuick Web Suite immediately. Update to version 22.0.9.1 or later, which addresses the SQL injection vulnerability in the username parameter. Contact BQE Software for upgrade guidance and licensing information.
- Identify all BillQuick Web Suite instances. Scan your environment for all installations of BQE BillQuick Web Suite versions 2018 through 2021 (< 22.0.9.1). Ensure no forgotten or shadow IT instances remain unpatched.
- Restrict network access to BillQuick. If immediate patching is not feasible, restrict access to the BillQuick Web Suite interface to trusted IP ranges only using firewall rules or web application firewalls. Block public internet access to the application.
- Disable xp_cmdshell on MSSQL Server. As a defense-in-depth measure, disable xp_cmdshell on the MSSQL Server instance used by BillQuick to prevent command execution even if SQL injection occurs.
- Scan for signs of prior compromise. Given the confirmed ransomware exploitation, thoroughly investigate systems running vulnerable BillQuick versions. Check for unauthorized database modifications, new user accounts, suspicious processes, and indicators of ransomware staging.
- Implement a web application firewall (WAF). Deploy WAF rules to detect and block SQL injection attempts targeting the BillQuick login interface as an additional layer of protection.
- Review and harden database permissions. Ensure the BillQuick database account uses least-privilege principles and does not have sysadmin or other elevated permissions on the MSSQL Server.
Technical Details
CVE-2021-42258 is a CRITICAL-severity vulnerability in BQE BillQuick Web Suite that can be exploited remotely over the network without physical access. The attack complexity is low, meaning no specialized conditions or preparation are required. No prior authentication or privileges are needed to initiate the attack. No user interaction is required, allowing fully automated exploitation.
Technical mechanism: The vulnerability exists in the login functionality of BillQuick Web Suite, specifically in the txtID (username) parameter. The application fails to properly sanitize or parameterize user input before incorporating it into SQL queries. An attacker can craft malicious SQL statements that are executed by the underlying MSSQL Server database engine. Through SQL injection, attackers can leverage xp_cmdshell — a built-in MSSQL stored procedure — to execute arbitrary operating system commands as the MSSQLSERVER$ service account.
Attack chain: The typical exploitation path involves: (1) sending a crafted SQL injection payload in the username field of the login page, (2) achieving arbitrary SQL execution on the MSSQL Server, (3) enabling and invoking xp_cmdshell to execute OS commands, and (4) deploying ransomware or establishing persistent access.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible attack with low complexity, no privileges required, no user interaction needed, and maximum impact across all three CIA triad dimensions.
Frequently Asked Questions
Is CVE-2021-42258 being actively exploited?
Yes, CVE-2021-42258 has been actively exploited in the wild since October 2021. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been directly linked to ransomware campaigns targeting organizations using BQE BillQuick Web Suite. The EPSS score of 0.93812 (99.86th percentile) confirms extremely high exploitation probability.
What products are affected by CVE-2021-42258?
BQE BillQuick Web Suite versions 2018 through 2021 before version 22.0.9.1 are affected. This includes all installations of the web-based billing and time tracking platform running vulnerable versions. Organizations should verify their BillQuick version and upgrade immediately if running an affected release.
How do I fix CVE-2021-42258?
Upgrade BQE BillQuick Web Suite to version 22.0.9.1 or later. If immediate patching is not possible, restrict network access to the BillQuick interface, disable xp_cmdshell on the MSSQL Server, and deploy WAF rules to block SQL injection attempts. After patching, investigate for signs of prior compromise given the confirmed ransomware exploitation.
How severe is CVE-2021-42258?
CVE-2021-42258 is rated CRITICAL with a CVSS 3.1 score of 9.8. It allows unauthenticated remote code execution via SQL injection and has been used in real-world ransomware attacks. The combination of trivial exploitability, no authentication requirement, and confirmed ransomware use makes this one of the highest-priority vulnerabilities for affected organizations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.