CVE-2021-42258: BQE BillQuick Web Suite SQL injection allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with confirmed in-the-wild exploitation for ransomware and a CVSS score of 9.8.

What it is

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 is vulnerable to SQL injection in the txtID (username) parameter, allowing unauthenticated attackers to execute arbitrary code. The flaw was exploited in the wild in October 2021 to install ransomware, making it a high-risk issue for exposed billing systems.

Impact

An attacker can execute arbitrary code as the MSSQLSERVER$ service account via xp_cmdshell, leading to full system compromise. This access was used in real attacks to deploy ransomware.

Attack surface

The vulnerability is reachable over the network through the web interface, requiring no authentication or user interaction. The CVSS vector confirms AV:N/AC:L/PR:N/UI:N.

Exploitation

Exploitation is confirmed in the wild: CISA KEV lists it with known ransomware campaign use, and EPSS probability is 0.744 (99.5th percentile). Reference tags include Exploit and Third Party Advisory.

What to do

• Apply the vendor update to BillQuick Web Suite version 22.0.9.1 or later immediately.
• If patching is not possible, isolate the web suite from untrusted networks and restrict access to trusted IPs.
• Disable or restrict xp_cmdshell in the underlying MSSQL server to limit post-exploitation capabilities.
• Monitor for and block SQL injection attempts targeting the txtID parameter at the web application firewall.
• Review MSSQLSERVER$ service account permissions and apply least privilege.

Detection

• Inspect web server logs for requests containing SQL injection patterns in the txtID parameter (e.g., quotes, UNION, xp_cmdshell).
• Monitor MSSQL logs for xp_cmdshell execution or unusual stored procedure calls.
• Hunt for unexpected child processes spawned by the MSSQLSERVER$ service account, such as cmd.exe or PowerShell.
• Use file integrity monitoring to detect unauthorized changes to BillQuick Web Suite files or new binaries in web directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.