Ransomware Attacks Perpetrated via Vulnerability in BillQuick Billing Software

guest · Oct 24, 2021

Ransomware Attacks Perpetrated via Vulnerability in BillQuick Billing Software
October 23, 2021
https://www.technadu.com/ransomware...ability-in-billquick-billing-software/308106/

A critical vulnerability that allowed remote code injection was discovered in multiple versions of the relatively popular BillQuick billing software.

The exploit comes from using MSSQL database injections that give access to CMDshell functions on the underlying OS.

The attacks permitted the hackers to access customer data and deploy malware.

Click to expand...

A vulnerability in BillQuick (a very popular billing app with over 400,000 users worldwide) that allows SQL injection for unauthenticated remote code execution was exploited in the wild this month for ransomware deployment. This critical flaw was given the number CVE-2021-42258, and it concerns the BQE BillQuick Web Suite 2018 through 2021, before 22.0.9.1.

The researcher’s team used SQL injection-based attacks to execute malicious commands on the target device. The vulnerability set includes the following CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, and CVE-2021-42742. All of these are part of the BillQuick WebSuite 2021 version 22.0.9.1.
Click to expand...

The team discovered a number of suspicious activities on the MSSQLSERVER$ service account thrown up by their Ransomware Canary files as well as Microsoft Defender antivirus.

Looking at the SQL injections, the researchers found some queries on the server-side code that allowed queries inserted into the MSSQL database. This enabled the injection of queries into the database via the login screen.
Click to expand...

Threat Advisory: Hackers Are Exploiting a Vulnerability in Popular Billing Software to Deploy Ransomware

Parting Thoughts
We really appreciate the BQE team’s timely responses to these vulnerability notifications. In 2021, it’s still extremely common for vendors to sweep cybersecurity issues under the rug; we have the impression that BQE is taking our feedback seriously.

With that said, this incident highlights a repeating pattern plaguing SMB software: well-established vendors are doing very little to proactively secure their applications and subject their unwitting customers to significant liability when sensitive data is inevitably leaked and/or ransomed.
Click to expand...

Log in or Sign up

Ransomware Attacks Perpetrated via Vulnerability in BillQuick Billing Software

guest Guest

Log in or Sign up

Ransomware Attacks Perpetrated via Vulnerability in BillQuick Billing Software

guest Guest

Useful Searches