Hackers Are Exploiting a Vulnerability in Billing Software to Deploy Ransomware | Huntress

Huntress discovered and publicly documented CVE-2021-42258, a critical SQL injection in BillQuick Web Suite that permits unauthenticated attackers to dump sensitive billing and user data and, when the database uses a privileged account (commonly sa), to enable xp_cmdshell and achieve remote code execution; the flaw was reproduced with sqlmap and observed being exploited to gain initial access and deploy ransomware in a victim environment.