CVE-2021-42258 : Security Advisory and Response

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. Learn about the impact, technical details, and mitigation strategies.

Understanding CVE-2021-42258

What is CVE-2021-42258?

BQE BillQuick Web Suite versions from 2018 to 2021 before 22.0.9.1 are vulnerable to SQL injection, enabling unauthenticated remote code execution. This vulnerability was exploited in October 2021 for ransomware deployment, allowing attackers to execute arbitrary code on affected systems.

The Impact of CVE-2021-42258

The vulnerability permits unauthenticated users to achieve remote code execution via SQL injection. Cybercriminals leveraged this exploit to install ransomware in October 2021, posing severe security risks to organizations using the affected versions of BQE BillQuick Web Suite.

Technical Details of CVE-2021-42258

Vulnerability Description

The flaw in BQE BillQuick Web Suite versions before 22.0.9.1 enables SQL injection, specifically through the txtID parameter, leading to the execution of arbitrary code as MSSQLSERVER$ via xp_cmdshell.

Affected Systems and Versions

Product: BQE BillQuick Web Suite
Versions Affected: 2018 to 2021 before 22.0.9.1

Exploitation Mechanism

Attackers exploit the txtID parameter via SQL injection to execute unauthorized code on vulnerable systems, potentially granting access to sensitive data or systems.

Mitigation and Prevention

Immediate Steps to Take

Update BQE BillQuick Web Suite to version 22.0.9.1 or higher to patch the SQL injection vulnerability.
Implement network segmentation to restrict access and minimize the impact of potential intrusions.

Long-Term Security Practices

Regularly perform security assessments and penetration testing to identify and address vulnerabilities proactively.
Educate employees on cybersecurity best practices to reduce the likelihood of successful attacks.

Patching and Updates

Stay informed about security updates from the software vendor and promptly apply patches to mitigate known vulnerabilities.