ZeroDay Findings
Sign inSign up

Findings

CVE-2021-42258

BQE BillQuick Web Suite SQL Injection Vulnerability

Published Oct 22, 2021 · updated Jun 16, 2026 · bqe billquick web suite

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 22, 2021 · Catalog

    Detected

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe bqe/billquick web suiteversion unspecified
  • vendor BQE BillQuick Web Suiteversion unspecified

Sources

  • CISA KEVCVE-2021-42258

    BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.

    cisa.gov
  • CVE.orgCVE-2021-42258

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-42258

    30-day exploitation probability 74.4%

    first.org
  • Metasploit Modulesauxiliary_gather/billquick_txtid_sqli

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-42258

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful explo

    nvd.nist.gov

References