# Hackers Are Exploiting a Vulnerability in Billing Software

Blind SQL injection in BillQuick Web Suite login form (txtID) let attackers dump the SecurityTable and run xp_cmdshell as sa, enabling ransomware deployment.

- Payout: Real-world hack
- Severity: critical
- Program: BQE BillQuick
- Credited: Huntress
- Disclosed: 2021-10-22
- CVE: CVE-2021-42258
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomwar
- Tags: domain:web impact:data-leak impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:rest technique:blind technique:source-review vuln:rce vuln:sqli

**Target:** BillQuick Web Suite 2020 login endpoint (txtID parameter) on IIS/MSSQL
**Root cause:** Login form concatenates user input into SQL queries, enabling blind SQLi; app authenticates to MSSQL as sa, so xp_cmdshell is reachable.
**Steps:**
1. POST login request to BillQuick Web Suite logon endpoint with `txtID='` to trigger SQL error/traceback
2. Save raw login request to `login-request.txt`; run `sqlmap -r login-request.txt -p txtID --time-sec=... --risk=3 --level=5`
3. Enumerate databases; identify `BQ2020`/`BQ2020ARK`
4. Dump `SecurityTable` to leak employee permission data and encoded passwords
5. Use stacked queries to re-enable `xp_cmdshell` and execute `powershell.exe` commands as MSSQLSERVER$
**How found:** Ransomware canary files tripped at an engineering company; Defender alerts showed malicious activity as MSSQLSERVER$ service account, suggesting a web app exploit. Logs showed a foreign IP repeatedly POSTing to the logon endpoint. Team downloaded WS2020, did static analysis, found concatenated SQL queries in the login function, and reproduced with sqlmap.
**Exploitation:** Attacker sent repeated POSTs to the logon endpoint from a foreign IP, exploited blind SQLi to dump credentials, then used stacked queries with sa privileges to re-enable xp_cmdshell and execute commands, gaining initial access and deploying ransomware across the victim network.
**Escalation:** SQLi data leak escalated to OS command execution via xp_cmdshell under sa, then to domain-wide ransomware.
**Insight:** When a vendor ships an on-prem appliance, download and install it locally to read the DB schema and setup docs; documented defaults like the sa account turn a plain SQLi into RCE via xp_cmdshell.