---
id: "CVE-2021-42258"
kind: "vulnerability"
aliases: ["CVE-2021-42258"]
title: "BQE BillQuick Web Suite: BQE BillQuick Web Suite SQL Injection Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.74426
exploited: true
status: "open"
category: "package"
products: [{"name": "BQE BillQuick Web Suite", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["bqe-billquick", "exploited", "package", "ransomware", "self-hosted", "windows"]
not_affected_if: ["not-running-billquick-web-suite"]
published_at: "2021-10-22T22:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42258", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-42258", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42258", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# BQE BillQuick Web Suite: BQE BillQuick Web Suite SQL Injection Vulnerability

BQE BillQuick Web Suite has an SQL injection flaw in the username parameter. An unauthenticated remote attacker can send crafted input to run SQL and may reach remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BQE BillQuick Web Suite affected ? fixed ?

## Fix

Apply the vendor's update per CISA guidance; the fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42258
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-42258
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-42258

## From the sources

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_