CVE Alert: CVE-2015-20128 – FooSun

FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

**Risk verdict:** Urgent: the known-exploited flag means any internet-reachable instance should be treated as priority 1 until exposure is ruled out or mitigated.

**Why this matters:** Unauthorised access could expose sensitive database records and permit limited data alteration, creating confidentiality and integrity risks. Database contents may also support follow-on fraud or attacks, depending on what the application account can access; the extent of that risk is uncertain without knowing its permissions.

**Most likely attack path:** An attacker can send crafted requests over the network, with low complexity and no credentials or user action required. Scope is unchanged, so impact is expected within the vulnerable service and its database boundary; lateral movement is not inherent, though stolen data or credentials could enable it.

**Who is most exposed:** Internet-facing deployments of legacy CMS applications, especially sites with the affected endpoint reachable from public networks. EPSS and SSVC exploitation-state data are not supplied, leaving prioritisation beyond the known-exploited flag uncertain.

Review web logs for requests to `/user/City_ajax.aspx` with unexpected or SQL-like `CityId` values.

Check MSSQL audit/query logs for unusual `UNION SELECT` activity or access to unexpected tables.

Look for anomalous response sizes or database errors associated with requests to this endpoint.

Mitigation and prioritisation:

Treat as priority 1; urgently identify and isolate exposed instances.

Apply a vendor-supported fix if available; otherwise disable or restrict the vulnerable endpoint and plan migration from unsupported software.

Temporarily limit access to trusted networks or place the application behind a WAF with targeted SQL-injection rules.

Preserve logs and validate database-account permissions; test controls before production changes.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.