{"id":"CVE-2015-20128","kind":"vulnerability","aliases":["CVE-2015-20128"],"related":[],"title":"FooSun DotNetCMS: unauthenticated SQL injection leaks database contents","description":"FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","summary":"FooSun DotNetCMS 1.0 and 2.0 concatenates the CityId parameter of /user/City_ajax.aspx into an MSSQL query with no authentication. Public PoCs and a Nuclei template exist, and Shadowserver saw exploitation from 2023-10-14. No vendor fix was found.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":null,"products":[{"name":"DotNetCMS","fixed":[],"affected":"1.0, 2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["asp.net","dotnetcms","mssql","other","self-hosted","sql-injection"],"not_affected_if":["not-foosun-dotnetcms","not-using-dotnetcms","other-version"],"how_to_check":"Look for /user/City_ajax.aspx on your site. Test with the Nuclei template dotnetcms-sqli, or grep web logs for City_ajax.aspx requests with CityId containing quotes, UNION, SELECT or ';'. Pages footed 'Powered by DotNetCMS' are running it.","fix":"No patched release found; vendor advisory unknown. Mitigate by removing or blocking /user/City_ajax.aspx at the WAF or IIS, running the DB account with least privilege, and migrating off DotNetCMS. If you were exposed, assume the database contents leaked and rotate credentials.","status":"open","published_at":"2026-10-20T21:17:13+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:32:47+00:00","updated_at":"2026-10-24T00:11:28+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:32:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FooSun DotNetCMS: unauthenticated SQL injection leaks database contents","impact":"high","summary":"FooSun DotNetCMS 1.0 and 2.0 fails to sanitize the CityId parameter sent to /user/City_ajax.aspx, which is concatenated into an MSSQL query. An unauthenticated attacker can use UNION SELECT payloads over plain GET requests to extract database information.","category":"other","who_cares":["dotnetcms","asp.net","mssql","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker reads database contents over unauthenticated web requests","analyst_note":"Confirm whether a patched FooSun release exists or whether the product is abandoned; check NVD https://nvd.nist.gov/vuln/detail/CVE-2015-20128 and Shadowserver reports for exploitation evidence.","how_to_check":"Search web server logs for requests to /user/City_ajax.aspx containing CityId values with UNION or SELECT.\nunknown","needs_analyst":true,"not_affected_if":["not-foosun-dotnetcms","other-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000524,"input_tokens":2985,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a patched FooSun release exists or whether the product is abandoned; check NVD https://nvd.nist.gov/vuln/detail/CVE-2015-20128 and Shadowserver reports for exploitation evidence.","search":"'-10':57B,121C '-14':58B,122C '-20128':11A,14A '-2015':10A,13A '/user/city_ajax.aspx':36B,92C '1.0':28B,66C '2.0':30B,68C '2023':56B,120C 'allow':75C 'asp.net':16B 'attack':77C,86C 'authent':43B 'citi':104C 'cityid':33B,84C,98C 'concaten':31B,99C 'contain':69C 'content':8A 'cve':9A,12A 'databas':7A,108C 'dotnetcm':2A,17B,27B,65C 'dotnetcms':15A 'evid':111C 'exist':50B 'exploit':54B,110C 'extract':107C 'first':113C 'fix':61B 'foosun':1A,26B,64C 'found':63B 'foundat':118C 'get':89C 'host':22B 'inform':109C 'inject':5A,25B,72C 'leak':6A 'manipul':79C 'mssql':18B,39B,80C 'nuclei':48B 'observ':114C 'paramet':34B,85C 'payload':96C 'poc':45B 'public':44B 'queri':40B,81C,105C 'request':90C 'saw':53B 'select':95C 'self':21B 'self-host':20B 'send':88C 'shadowserv':52B,117C 'sql':4A,24B,71C 'sql-inject':23B 'sys':103C 'templat':49B 'unauthent':3A,76C 'union':94C 'unsanit':100C 'vendor':60B 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":2,"sources":[{"source":"nvd","external_id":"CVE-2015-20128","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-20128","severity":null,"published_at":"2026-10-20T21:17:13+00:00","modified_at":"2026-10-23T16:16:50+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2015-20128:608","url":null,"severity":null,"published_at":"2026-10-24T00:11:28+00:00","modified_at":"2026-10-24T00:11:28+00:00","first_seen_at":"2026-10-24T00:11:28+00:00","fetched_at":"2026-10-24T00:11:28+00:00","note":"CVE published 2026-10-20 for a 2015 bug (rebeyond writeup, Nov 2015); VulnCheck/CVE record cite Shadowserver exploitation first seen 2023-10-14; public PoC and Nuclei template exist. No vendor advisory or patched release found; product appears abandoned (unconfirmed). Read via search snippets; NVD page returned empty."}],"documents":[{"id":2464,"url":"https://www.vulncheck.com/advisories/foosun-dotnetcms-1.0-2.0-sql-injection-via-city-ajax-aspx","title":"VulnCheck: FooSun DotNetCMS SQLi via City_ajax.aspx","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2465,"url":"https://www.cnblogs.com/rebeyond/p/4951418.html","title":"rebeyond: DotNetCMS V1.0-V2.0 SQL injection (2015)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2466,"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/dotnetcms-sqli.yaml","title":"Nuclei template dotnetcms-sqli","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}