CVE-2021-42258
CRITICAL KEV RANSOMWARE NUCLEIBQE BillQuick Web Suite 2018-2021 < 22.0.9.1 - Unauthenticated SQL Injection via txtID Parameter
Title source: llmExploitation Summary
CVE-2021-42258 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns.
EIP tracks 1 public exploit from researchers including h00die, including a Metasploit module auxiliary/gather/billquick_txtid_sqli.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a SQL injection vulnerability in BillQuick Web Suite prior to version 22.0.9.1. It extracts database information, including the database name, banner, user, hostname, and the SecurityTable (user table).
Description
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
Exploits (1)
This Metasploit module exploits a SQL injection vulnerability in BillQuick Web Suite prior to version 22.0.9.1. It extracts database information, including the database name, banner, user, hostname, and the SecurityTable (user table).
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H