---
id: "CVE-2015-20128"
kind: "vulnerability"
aliases: ["CVE-2015-20128"]
title: "FooSun DotNetCMS: unauthenticated SQL injection leaks database contents"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "DotNetCMS", "fixed": [], "affected": "1.0, 2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["asp.net", "dotnetcms", "mssql", "other", "self-hosted", "sql-injection"]
not_affected_if: ["not-foosun-dotnetcms", "not-using-dotnetcms", "other-version"]
published_at: "2026-10-20T21:17:13+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-24T00:11:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-20128", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:11:28+00:00"}]
---

# FooSun DotNetCMS: unauthenticated SQL injection leaks database contents

FooSun DotNetCMS 1.0 and 2.0 concatenates the CityId parameter of /user/City_ajax.aspx into an MSSQL query with no authentication. Public PoCs and a Nuclei template exist, and Shadowserver saw exploitation from 2023-10-14. No vendor fix was found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DotNetCMS affected 1.0, 2.0 fixed ?

## How to check

Look for /user/City_ajax.aspx on your site. Test with the Nuclei template dotnetcms-sqli, or grep web logs for City_ajax.aspx requests with CityId containing quotes, UNION, SELECT or ';'. Pages footed 'Powered by DotNetCMS' are running it.

## Fix

No patched release found; vendor advisory unknown. Mitigate by removing or blocking /user/City_ajax.aspx at the WAF or IIS, running the DB account with least privilege, and migrating off DotNetCMS. If you were exposed, assume the database contents leaked and rotate credentials.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-20128
- 2026-10-24T00:11:28+00:00 analyst — CVE published 2026-10-20 for a 2015 bug (rebeyond writeup, Nov 2015); VulnCheck/CVE record cite Shadowserver exploitation first seen 2023-10-14; public PoC and Nuclei template exist. No vendor advisory or patched release found; product appears abandoned (unconfirmed). Read via search snippets; NVD page returned empty.

## Documents

- [advisory] VulnCheck: FooSun DotNetCMS SQLi via City_ajax.aspx https://www.vulncheck.com/advisories/foosun-dotnetcms-1.0-2.0-sql-injection-via-city-ajax-aspx
- [poc] rebeyond: DotNetCMS V1.0-V2.0 SQL injection (2015) https://www.cnblogs.com/rebeyond/p/4951418.html
- [poc] Nuclei template dotnetcms-sqli https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/dotnetcms-sqli.yaml

## From the sources

FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_