CVE-2015-20128 in DotNetCMS
Summary
by MITRE • 10/20/2026
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
FooSun DotNetCMS versions 1.0 and 2.0 are susceptible to a critical SQL injection vulnerability that stems from insufficient input validation within the application's handling of user-supplied data. The specific point of failure is located in the CityId parameter, which is processed by the /user/City_ajax.aspx endpoint. This component appears to be designed for dynamic content loading related to city selection or filtering, a common feature in web applications that require geographic context. However, the underlying code fails to properly sanitize or parameterize this input before incorporating it into database queries targeting the MSSQL backend. As a result, any data submitted via the CityId field is directly concatenated into SQL statements without adequate checks for malicious syntax, creating an avenue for unauthenticated attackers to interfere with query logic.
The technical mechanism of exploitation involves sending specially crafted GET requests to the vulnerable endpoint using UNION SELECT payloads within the CityId parameter. By injecting these payloads, an attacker can manipulate the structure of the original sys_City database query. This technique allows the injection point to return additional result sets from other tables in the database alongside the legitimate data intended for display. Through this method, attackers can extract sensitive information such as usernames, password hashes, configuration details, and potentially full control over the underlying Microsoft SQL Server instance if the service account has elevated privileges. The lack of input validation means that even complex multi-step injection techniques are viable, enabling comprehensive database enumeration and data exfiltration without requiring any form of authentication or user interaction beyond a single HTTP request.
The operational impact of this vulnerability is severe, as it compromises the confidentiality and integrity of the entire application's data store. Since FooSun DotNetCMS is often used for content management in enterprise environments, the exposure of database contents can lead to significant business disruption, regulatory non-compliance due to leaked personal or sensitive information, and potential further compromise of internal network infrastructure if lateral movement techniques are employed using extracted credentials. The fact that exploitation evidence was first observed by the Shadowserver Foundation on October 14, 2023, indicates that this vulnerability is actively being exploited in the wild by threat actors who have likely developed automated tools to scan for and exploit instances of this software across the internet. This active exploitation trend underscores the urgency for immediate remediation efforts among affected organizations.
From a classification perspective, this flaw aligns with CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. It also maps to MITRE ATT&CK techniques such as T1059.004: PowerShell or command-line interpretation if the attacker escalates privileges via xp_cmdshell, and more broadly to data exfiltration tactics like T1005: Data from Local System. To mitigate this risk, immediate patching of FooSun DotNetCMS to a version that addresses this vulnerability is required. In cases where patching is not immediately feasible, implementing Web Application Firewall rules to detect and block UNION SELECT patterns in query parameters can provide temporary protection. Additionally, developers should review all database interaction code to ensure the use of parameterized queries or prepared statements rather than string concatenation for building SQL commands, thereby eliminating similar injection points across the application architecture.