virus logo FortiClient Vulnerability

BillQuick Web Suite CVE-2021-42258 SQL Injection Vulnerability

description-logoDescription

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

affected-products-logoAffected Applications

BillQuick Web Suite

CVE References

CVE-2021-42258

Other References

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42258
ID 4972
Created Jul 11, 2023
Description
Updated		 Jul 11, 2023
Risk black-background-circle-icon black-background-circle-icon black-background-circle-icon black-background-circle-icon black-background-circle-icon
Coverage FortiClient
OS Windows
Vendor BQE Software
Patch manual
Application BillQuick Web Suite