{"id":"CVE-2021-42258","kind":"vulnerability","aliases":["CVE-2021-42258"],"related":[],"title":"BQE BillQuick Web Suite: BQE BillQuick Web Suite SQL Injection Vulnerability","description":"BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.","summary":"BQE BillQuick Web Suite has an SQL injection flaw in the username parameter. An unauthenticated remote attacker can send crafted input to run SQL and may reach remote code execution.","severity":"critical","cvss":9.8,"epss":0.74426,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"BQE BillQuick Web Suite","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bqe-billquick","exploited","package","ransomware","self-hosted","windows"],"not_affected_if":["not-running-billquick-web-suite"],"how_to_check":null,"fix":"Apply the vendor's update per CISA guidance; the fixed version is unknown from the sources.","status":"open","published_at":"2021-10-22T22:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:51+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:33:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's update per CISA guidance; the fixed version is unknown from the sources.","reach":"internet","impact":"high","summary":"BQE BillQuick Web Suite has an SQL injection flaw in the username parameter. An unauthenticated remote attacker can send crafted input to run SQL and may reach remote code execution.","category":"package","who_cares":["bqe-billquick","self-hosted","windows"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs SQL and may execute code on the server","analyst_note":"Find the vendor advisory and fixed BillQuick Web Suite version, and a way to check for the username parameter flaw; the sources do not give either.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-running-billquick-web-suite"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000452,"input_tokens":2849,"output_tokens":334,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the vendor advisory and fixed BillQuick Web Suite version, and a way to check for the username parameter flaw; the sources do not give either.","search":"'-2021':13A,16A '-42258':14A,17A '2018':66C '2021':68C,86C '22.0.9.1':70C 'abil':106C 'aka':98C 'allow':71C 'arbitrari':109C 'attack':48B 'billquick':2A,6A,19A,24B,33B,63C 'bqe':1A,5A,18A,23B,32B,62C 'bqe-billquick':22B 'cmdshell':115C 'code':60B,77C,110C 'craft':51B 'cve':12A,15A 'exampl':94C 'execut':61B,78C,108C 'exploit':25B,80C,102C 'flaw':40B 'host':30B 'includ':104C 'inject':10A,39B,73C,91C 'input':52B 'instal':89C 'may':57B 'mssqlserver':112C 'octob':85C 'packag':26B 'paramet':44B,100C 'ransomwar':27B,88C 'reach':58B 'remot':47B,59B,76C 'run':54B 'self':29B 'self-host':28B 'send':50B 'sql':9A,38B,55B,72C,90C 'success':101C 'suit':4A,8A,35B,65C 'suite':21A 'txtid':97C 'unauthent':46B,75C 'use':95C 'usernam':43B,99C 'via':113C 'vulner':11A 'web':3A,7A,20A,34B,64C 'wild':83C 'window':31B 'xp':114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-10-22T22:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-42258","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42258","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2021-42258","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42258","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-42258","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42258","severity":null,"published_at":"2021-10-22T22:15:07+00:00","modified_at":"2026-06-17T04:09:31+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}