Hackers Exploited Popular BillQuick Billing Software to Deploy Ransomware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-42258 | Unauthenticated SQL Injection RCE in BQE BillQuick Web Suite CVE-2021-42258 is an unauthenticated SQL injection flaw (CWE-89) in BQE BillQuick Web Suite 2018 through 2021, fixed in version 22.0.9.1, that can be triggered through user-supplied input such as the txtID (username) parameter of the web interface. Because attacker-controlled input reaches the backend Microsoft SQL Server, an unauthenticated attacker with network access to the web suite can inject SQL and abuse xp_cmdshell to execute arbitrary code on the database server under the MSSQLSERVER$ account. This yields full unauthenticated remote code execution, and in observed intrusions it was used to deploy ransomware. Any organization running an affected BillQuick Web Suite release is affected, particularly those exposing the billing portal directly to the internet. The flaw is actively exploited in the wild (added to CISA KEV on 2021-11-03 with known ransomware use) and carries a high EPSS score of 74.4%, making urgent patching advisable. Do: Upgrade BillQuick Web Suite to version 22.0.9.1 or later per BQE's instructions, as required by the CISA KEV entry. Until patched, restrict internet-facing access to the Web Suite server and review logs for SQL injection attempts against the username (txtID) parameter, unexpected xp_cmdshell usage, or commands running as MSSQLSERVER$; the referenced Huntress advisory includes indicators of compromise for the October 2021 ransomware campaign. | 9.8 | 74% | KEV ransomware PoC |
| nichelikely low thousands of installations worldwide, with only hundreds of internet-exposed instances |
Full article336 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 25, 2021
Cybersecurity researchers on Friday disclosed a now-patched critical vulnerability in multiple versions of a time and billing system called BillQuick that's being actively exploited by threat actors to deploy ransomware on vulnerable systems.
CVE-2021-42258, as the flaw is being tracked as, concerns an SQL-based injection attack that allows for remote code execution and was successfully leveraged to gain initial access to an unnamed U.S. engineering company and mount a ransomware attack, American cybersecurity firm Huntress Labs said.
While the issue has been addressed by BQE Software in BillQuick version 22.0.9.1 released on October 7, eight other undisclosed security issues that were identified as part of the investigation are yet to be patched. According to its website, BQE Software's products are used by 400,000 users worldwide.
"Hackers can use this to access customers' BillQuick data and run malicious commands on their on-premises Windows servers," Huntress Labs threat researcher Caleb Stewart said in a write-up. "This incident highlights a repeating pattern plaguing SMB software: well-established vendors are doing very little to proactively secure their applications and subject their unwitting customers to significant liability when sensitive data is inevitably leaked and/or ransomed."
Essentially, the vulnerability stems from how BillQuick Web Suite 2020 constructs SQL database queries, enabling attackers to inject a specially-crafted SQL via the application's login form that could be used to remotely spawn a command shell on the underlying Windows operating system and achieve code execution, which, in turn, is made possible by the fact that the software runs as the "System Administrator" user.
"Hackers are constantly looking for low-hanging fruit and vulnerabilities that can be exploited—and they're not always poking around in 'big' mainstream applications like Office," Stewart said. "Sometimes, a productivity tool or even an add-on can be the door that hackers step through to gain access to an environment and carry out their next move."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/10/hackers-exploited-popular-billquick.html