CRITICAL CISA KEV

CVE-2021-42258

CVSS v3

9.8

CRITICAL

EPSS Score

93.8%

exploit probability

CISA KEV

Yes

known exploited

Exploitation

SSVC status

Description

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

CISA Known Exploited Vulnerability

Date Added
11/3/2021
Patch Due Date
11/17/2021
Ransomware Use
Known

Technical details

Published
10/22/2021

Frequently asked questions

What is CVE-2021-42258?

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

Is CVE-2021-42258 actively exploited?

Yes. CVE-2021-42258 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 11/17/2021.

What is the CVSS score for CVE-2021-42258?

CVE-2021-42258 has a CVSS v3 base score of 9.8 (CRITICAL severity).

Is CVE-2021-42258 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.