Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-42258: BillQuick Web Suite allows remote code execution via username field
CVE-2021-42258 · published 5 years ago · actively exploited
Summary
The BillQuick Web Suite web application can be tricked into running malicious commands when it processes the username input. An attacker could exploit this without needing a login, potentially taking control of the server. Apply the vendor's security update or disable the vulnerable feature as soon as possible.
What to do
- Update bqe billquick_web_suite to version 22.0.9.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| bqe | billquick web suite | All versions |
| bqe | billquick_web_suite |
>= 19, < 22.0.9.1 cpe:2.3:a:bqe:billquick_web_suite:*:*:*:*:*:*:*:* |
Original advisory text
BQE BillQuick Web Suite SQL Injection Vulnerability
BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.
References
- https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerabi... Exploit Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
75%
chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published22 Oct 2021
Updated28 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta