CVE-2021-42258 — BQE BillQuick Web Suite SQL Injection Vulnerability

provenance: imported · CVE: CVE-2021-42258

CVE-2021-42258: BQE BillQuick Web Suite SQL Injection Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	BQE
Product	BillQuick Web Suite
Date added	2021-11-03
Due date	2021-11-17
Ransomware campaign use	Known

Description

BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-42258

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-42258
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog