Skip to content
Urgent CVE-2015-20128 SQL Injection Vulnerability in FooSun DotNetCMS

Urgent CVE-2015-20128 SQL Injection Vulnerability in FooSun DotNetCMS

First seen 21 Oct 2026, 01:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 02:20 UTC
  • •CVE-2015-20128 affects FooSun DotNetCMS versions 1.0 and 2.0.
  • •SQL injection vulnerability allows unauthorized database access through crafted GET requests.
  • •Immediate action is required for internet-facing deployments to mitigate risks.

FooSun DotNetCMS versions 1.0 and 2.0 contain an SQL injection vulnerability (CVE-2015-20128) that allows unauthenticated attackers to manipulate MSSQL queries via the CityId parameter. Exploitation was first observed on October 14, 2023, with attackers able to send crafted GET requests to /user/City_ajax.aspx using UNION SELECT payloads. This vulnerability poses significant risks, including unauthorized access to sensitive database records and potential data alteration. Internet-facing deployments of legacy CMS applications are particularly at risk, especially those with the vulnerable endpoint exposed to public networks. The current status is urgent, with a known-exploited flag indicating immediate action is required to mitigate exposure. Administrators are advised to review web logs for suspicious activity and apply vendor-supported fixes or restrict access to the vulnerable endpoint.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2023-10-14
First exploitation observed
Attackers began exploiting the SQL injection vulnerability in FooSun DotNetCMS.
Redpacketsecurity
2026-10-20
CVE-2015-20128 published
CVE-2015-20128 was officially published, highlighting the SQL injection vulnerability.
Redpacketsecurity

More articles in this cluster (2)

Following this threat?

Track CVE-2015-20128 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 4

Common questions

Which versions of FooSun DotNetCMS are affected?
FooSun DotNetCMS versions 1.0 and 2.0 are affected by CVE-2015-20128.
Is there evidence of active exploitation?
Yes, exploitation was first observed on October 14, 2023, indicating that attackers are actively targeting this vulnerability.
What should I do to protect my systems?
Immediately review web logs for suspicious activity, apply any available vendor fixes, or restrict access to the vulnerable endpoint.