module
BillQuick Web Suite txtID SQLi
| Disclosed |
|---|
| Oct 22, 2021 |
Disclosed
Oct 22, 2021
Description
This module exploits a SQL injection vulnerability in BillQUick Web Suite prior to version 22.0.9.1.
The application is .net based, and the database is required to be MSSQL. Luckily the website gives
error based SQLi messages, so it is trivial to pull data from the database. However the webapp
uses an unknown password security algorithm. This vulnerability does not seem to support stacked
queries.
This module pulls the database name, banner, user, hostname, and the SecurityTable (user table).
The application is .net based, and the database is required to be MSSQL. Luckily the website gives
error based SQLi messages, so it is trivial to pull data from the database. However the webapp
uses an unknown password security algorithm. This vulnerability does not seem to support stacked
queries.
This module pulls the database name, banner, user, hostname, and the SecurityTable (user table).
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.