Description
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection that allows unauthenticated attackers to read database information
Action: Patch immediately
AI Analysis

Impact

FooSun DotNetCMS 1.0 and 2.0 contain an SQL injection vulnerability in the CityId parameter of City_ajax.aspx. Unauthenticated attackers can craft GET requests containing UNION SELECT payloads. The input is concatenated unsanitized into a MSSQL query, allowing extraction or enumeration of database information. This flaw is classified as CWE-89.

Affected Systems

The affected products are FooSun DotNetCMS versions 1.0 and 2.0. No additional version details are provided. Systems running either of these versions and exposing the /user/City_ajax.aspx endpoint are vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation can be performed from the internet through unauthenticated GET requests; attackers would need network reach to the application and access to the underlying MSSQL database. Evidence of exploitation was reported in October 2023, confirming that the flaw can be used by attackers that are on the same network or have internet exposure to the application.

Generated by OpenCVE AI on October 20, 2026 at 21:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade FooSun DotNetCMS to a version where the City_ajax.aspx parameter is properly validated.
  • Restrict or block external access to /user/City_ajax.aspx, allowing only authenticated requests.
  • Implement input validation to accept only numeric values for CityId, and use parameterized queries.
  • Deploy a web application firewall with SQL injection detection rules targeting this endpoint.

Generated by OpenCVE AI on October 20, 2026 at 21:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Foosun
Foosun dotnetcms
Vendors & Products Foosun
Foosun dotnetcms

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Title FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Foosun Dotnetcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-23T15:21:40.984Z

Reserved: 2026-10-14T20:25:24.126Z

Link: CVE-2015-20128

cve-icon Vulnrichment

Updated: 2026-10-23T15:21:37.524Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T21:17:13.357

Modified: 2026-10-23T16:16:50.197

Link: CVE-2015-20128

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T14:59:51Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')